meshy-node 0.0.6 → 0.0.8

package/main.cjs

@@ -14251,11 +14251,11 @@ var require_mime_types = __commonJS({
       }
       return exts[0];
     }
-    function lookup(path16) {
-      if (!path16 || typeof path16 !== "string") {
+    function lookup(path17) {
+      if (!path17 || typeof path17 !== "string") {
         return false;
       }
-      var extension2 = extname3("x." + path16).toLowerCase().substr(1);
+      var extension2 = extname3("x." + path17).toLowerCase().substr(1);
       if (!extension2) {
         return false;
       }
@@ -17773,7 +17773,7 @@ var require_path_to_regexp = __commonJS({
     "use strict";
     module2.exports = pathToRegexp;
     var MATCHING_GROUP_REGEXP = /\\.|\((?:\?<(.*?)>)?(?!\?)/g;
-    function pathToRegexp(path16, keys, options) {
+    function pathToRegexp(path17, keys, options) {
       options = options || {};
       keys = keys || [];
       var strict = options.strict;
@@ -17787,8 +17787,8 @@ var require_path_to_regexp = __commonJS({
       var pos = 0;
       var backtrack = "";
       var m;
-      if (path16 instanceof RegExp) {
-        while (m = MATCHING_GROUP_REGEXP.exec(path16.source)) {
+      if (path17 instanceof RegExp) {
+        while (m = MATCHING_GROUP_REGEXP.exec(path17.source)) {
           if (m[0][0] === "\\") continue;
           keys.push({
             name: m[1] || name++,
@@ -17796,18 +17796,18 @@ var require_path_to_regexp = __commonJS({
             offset: m.index
           });
         }
-        return path16;
+        return path17;
       }
-      if (Array.isArray(path16)) {
-        path16 = path16.map(function(value) {
+      if (Array.isArray(path17)) {
+        path17 = path17.map(function(value) {
           return pathToRegexp(value, keys, options).source;
         });
-        return new RegExp(path16.join("|"), flags);
+        return new RegExp(path17.join("|"), flags);
       }
-      if (typeof path16 !== "string") {
+      if (typeof path17 !== "string") {
         throw new TypeError("path must be a string, array of strings, or regular expression");
       }
-      path16 = path16.replace(
+      path17 = path17.replace(
         /\\.|(\/)?(\.)?:(\w+)(\(.*?\))?(\*)?(\?)?|[.*]|\/\(/g,
         function(match, slash, format, key, capture, star, optional, offset) {
           if (match[0] === "\\") {
@@ -17824,7 +17824,7 @@ var require_path_to_regexp = __commonJS({
           if (slash || format) {
             backtrack = "";
           } else {
-            backtrack += path16.slice(pos, offset);
+            backtrack += path17.slice(pos, offset);
           }
           pos = offset + match.length;
           if (match === "*") {
@@ -17854,7 +17854,7 @@ var require_path_to_regexp = __commonJS({
           return result;
         }
       );
-      while (m = MATCHING_GROUP_REGEXP.exec(path16)) {
+      while (m = MATCHING_GROUP_REGEXP.exec(path17)) {
         if (m[0][0] === "\\") continue;
         if (keysOffset + i === keys.length || keys[keysOffset + i].offset > m.index) {
           keys.splice(keysOffset + i, 0, {
@@ -17866,13 +17866,13 @@ var require_path_to_regexp = __commonJS({
         }
         i++;
       }
-      path16 += strict ? "" : path16[path16.length - 1] === "/" ? "?" : "/?";
+      path17 += strict ? "" : path17[path17.length - 1] === "/" ? "?" : "/?";
       if (end) {
-        path16 += "$";
-      } else if (path16[path16.length - 1] !== "/") {
-        path16 += lookahead ? "(?=/|$)" : "(?:/|$)";
+        path17 += "$";
+      } else if (path17[path17.length - 1] !== "/") {
+        path17 += lookahead ? "(?=/|$)" : "(?:/|$)";
       }
-      return new RegExp("^" + path16, flags);
+      return new RegExp("^" + path17, flags);
     }
   }
 });
@@ -17885,19 +17885,19 @@ var require_layer = __commonJS({
     var debug = require_src()("express:router:layer");
     var hasOwnProperty = Object.prototype.hasOwnProperty;
     module2.exports = Layer;
-    function Layer(path16, options, fn) {
+    function Layer(path17, options, fn) {
       if (!(this instanceof Layer)) {
-        return new Layer(path16, options, fn);
+        return new Layer(path17, options, fn);
       }
-      debug("new %o", path16);
+      debug("new %o", path17);
       var opts = options || {};
       this.handle = fn;
       this.name = fn.name || "<anonymous>";
       this.params = void 0;
       this.path = void 0;
-      this.regexp = pathRegexp(path16, this.keys = [], opts);
-      this.regexp.fast_star = path16 === "*";
-      this.regexp.fast_slash = path16 === "/" && opts.end === false;
+      this.regexp = pathRegexp(path17, this.keys = [], opts);
+      this.regexp.fast_star = path17 === "*";
+      this.regexp.fast_slash = path17 === "/" && opts.end === false;
     }
     Layer.prototype.handle_error = function handle_error(error, req, res, next) {
       var fn = this.handle;
@@ -17921,20 +17921,20 @@ var require_layer = __commonJS({
         next(err);
       }
     };
-    Layer.prototype.match = function match(path16) {
+    Layer.prototype.match = function match(path17) {
       var match2;
-      if (path16 != null) {
+      if (path17 != null) {
         if (this.regexp.fast_slash) {
           this.params = {};
           this.path = "";
           return true;
         }
         if (this.regexp.fast_star) {
-          this.params = { "0": decode_param(path16) };
-          this.path = path16;
+          this.params = { "0": decode_param(path17) };
+          this.path = path17;
           return true;
         }
-        match2 = this.regexp.exec(path16);
+        match2 = this.regexp.exec(path17);
       }
       if (!match2) {
         this.params = void 0;
@@ -18027,10 +18027,10 @@ var require_route = __commonJS({
     var slice = Array.prototype.slice;
     var toString = Object.prototype.toString;
     module2.exports = Route;
-    function Route(path16) {
-      this.path = path16;
+    function Route(path17) {
+      this.path = path17;
       this.stack = [];
-      debug("new %o", path16);
+      debug("new %o", path17);
       this.methods = {};
     }
     Route.prototype._handles_method = function _handles_method(method) {
@@ -18243,8 +18243,8 @@ var require_router = __commonJS({
         if (++sync > 100) {
           return setImmediate(next, err);
         }
-        var path16 = getPathname(req);
-        if (path16 == null) {
+        var path17 = getPathname(req);
+        if (path17 == null) {
           return done(layerError);
         }
         var layer;
@@ -18252,7 +18252,7 @@ var require_router = __commonJS({
         var route;
         while (match !== true && idx < stack.length) {
           layer = stack[idx++];
-          match = matchLayer(layer, path16);
+          match = matchLayer(layer, path17);
           route = layer.route;
           if (typeof match !== "boolean") {
             layerError = layerError || match;
@@ -18290,18 +18290,18 @@ var require_router = __commonJS({
           } else if (route) {
             layer.handle_request(req, res, next);
           } else {
-            trim_prefix(layer, layerError, layerPath, path16);
+            trim_prefix(layer, layerError, layerPath, path17);
           }
           sync = 0;
         });
       }
-      function trim_prefix(layer, layerError, layerPath, path16) {
+      function trim_prefix(layer, layerError, layerPath, path17) {
         if (layerPath.length !== 0) {
-          if (layerPath !== path16.slice(0, layerPath.length)) {
+          if (layerPath !== path17.slice(0, layerPath.length)) {
             next(layerError);
             return;
           }
-          var c = path16[layerPath.length];
+          var c = path17[layerPath.length];
           if (c && c !== "/" && c !== ".") return next(layerError);
           debug("trim prefix (%s) from url %s", layerPath, req.url);
           removed = layerPath;
@@ -18379,7 +18379,7 @@ var require_router = __commonJS({
     };
     proto.use = function use(fn) {
       var offset = 0;
-      var path16 = "/";
+      var path17 = "/";
       if (typeof fn !== "function") {
         var arg = fn;
         while (Array.isArray(arg) && arg.length !== 0) {
@@ -18387,7 +18387,7 @@ var require_router = __commonJS({
         }
         if (typeof arg !== "function") {
           offset = 1;
-          path16 = fn;
+          path17 = fn;
         }
       }
       var callbacks = flatten(slice.call(arguments, offset));
@@ -18399,8 +18399,8 @@ var require_router = __commonJS({
         if (typeof fn !== "function") {
           throw new TypeError("Router.use() requires a middleware function but got a " + gettype(fn));
         }
-        debug("use %o %s", path16, fn.name || "<anonymous>");
-        var layer = new Layer(path16, {
+        debug("use %o %s", path17, fn.name || "<anonymous>");
+        var layer = new Layer(path17, {
           sensitive: this.caseSensitive,
           strict: false,
           end: false
@@ -18410,9 +18410,9 @@ var require_router = __commonJS({
       }
       return this;
     };
-    proto.route = function route(path16) {
-      var route2 = new Route(path16);
-      var layer = new Layer(path16, {
+    proto.route = function route(path17) {
+      var route2 = new Route(path17);
+      var layer = new Layer(path17, {
         sensitive: this.caseSensitive,
         strict: this.strict,
         end: true
@@ -18422,8 +18422,8 @@ var require_router = __commonJS({
       return route2;
     };
     methods.concat("all").forEach(function(method) {
-      proto[method] = function(path16) {
-        var route = this.route(path16);
+      proto[method] = function(path17) {
+        var route = this.route(path17);
         route[method].apply(route, slice.call(arguments, 1));
         return this;
       };
@@ -18459,9 +18459,9 @@ var require_router = __commonJS({
       }
       return toString.call(obj).replace(objectRegExp, "$1");
     }
-    function matchLayer(layer, path16) {
+    function matchLayer(layer, path17) {
       try {
-        return layer.match(path16);
+        return layer.match(path17);
       } catch (err) {
         return err;
       }
@@ -18579,13 +18579,13 @@ var require_view = __commonJS({
   "../../node_modules/.pnpm/express@4.22.1/node_modules/express/lib/view.js"(exports2, module2) {
     "use strict";
     var debug = require_src()("express:view");
-    var path16 = require("path");
+    var path17 = require("path");
     var fs17 = require("fs");
-    var dirname3 = path16.dirname;
-    var basename4 = path16.basename;
-    var extname3 = path16.extname;
-    var join12 = path16.join;
-    var resolve10 = path16.resolve;
+    var dirname3 = path17.dirname;
+    var basename4 = path17.basename;
+    var extname3 = path17.extname;
+    var join13 = path17.join;
+    var resolve10 = path17.resolve;
     module2.exports = View;
     function View(name, options) {
       var opts = options || {};
@@ -18614,17 +18614,17 @@ var require_view = __commonJS({
       this.path = this.lookup(fileName);
     }
     View.prototype.lookup = function lookup(name) {
-      var path17;
+      var path18;
       var roots = [].concat(this.root);
       debug('lookup "%s"', name);
-      for (var i = 0; i < roots.length && !path17; i++) {
+      for (var i = 0; i < roots.length && !path18; i++) {
         var root = roots[i];
         var loc = resolve10(root, name);
         var dir = dirname3(loc);
         var file = basename4(loc);
-        path17 = this.resolve(dir, file);
+        path18 = this.resolve(dir, file);
       }
-      return path17;
+      return path18;
     };
     View.prototype.render = function render(options, callback) {
       debug('render "%s"', this.path);
@@ -18632,21 +18632,21 @@ var require_view = __commonJS({
     };
     View.prototype.resolve = function resolve11(dir, file) {
       var ext = this.ext;
-      var path17 = join12(dir, file);
-      var stat = tryStat(path17);
+      var path18 = join13(dir, file);
+      var stat = tryStat(path18);
       if (stat && stat.isFile()) {
-        return path17;
+        return path18;
       }
-      path17 = join12(dir, basename4(file, ext), "index" + ext);
-      stat = tryStat(path17);
+      path18 = join13(dir, basename4(file, ext), "index" + ext);
+      stat = tryStat(path18);
       if (stat && stat.isFile()) {
-        return path17;
+        return path18;
       }
     };
-    function tryStat(path17) {
-      debug('stat "%s"', path17);
+    function tryStat(path18) {
+      debug('stat "%s"', path18);
       try {
-        return fs17.statSync(path17);
+        return fs17.statSync(path18);
       } catch (e) {
         return void 0;
       }
@@ -19002,7 +19002,7 @@ var require_types = __commonJS({
 var require_mime = __commonJS({
   "../../node_modules/.pnpm/mime@1.6.0/node_modules/mime/mime.js"(exports2, module2) {
     "use strict";
-    var path16 = require("path");
+    var path17 = require("path");
     var fs17 = require("fs");
     function Mime() {
       this.types = /* @__PURE__ */ Object.create(null);
@@ -19032,8 +19032,8 @@ var require_mime = __commonJS({
       this.define(map);
       this._loading = null;
     };
-    Mime.prototype.lookup = function(path17, fallback) {
-      var ext = path17.replace(/^.*[\.\/\\]/, "").toLowerCase();
+    Mime.prototype.lookup = function(path18, fallback) {
+      var ext = path18.replace(/^.*[\.\/\\]/, "").toLowerCase();
       return this.types[ext] || fallback || this.default_type;
     };
     Mime.prototype.extension = function(mimeType) {
@@ -19268,28 +19268,28 @@ var require_send = __commonJS({
     var ms = require_ms2();
     var onFinished = require_on_finished();
     var parseRange = require_range_parser();
-    var path16 = require("path");
+    var path17 = require("path");
     var statuses = require_statuses();
     var Stream = require("stream");
     var util2 = require("util");
-    var extname3 = path16.extname;
-    var join12 = path16.join;
-    var normalize = path16.normalize;
-    var resolve10 = path16.resolve;
-    var sep3 = path16.sep;
+    var extname3 = path17.extname;
+    var join13 = path17.join;
+    var normalize = path17.normalize;
+    var resolve10 = path17.resolve;
+    var sep3 = path17.sep;
     var BYTES_RANGE_REGEXP = /^ *bytes=/;
     var MAX_MAXAGE = 60 * 60 * 24 * 365 * 1e3;
     var UP_PATH_REGEXP = /(?:^|[\\/])\.\.(?:[\\/]|$)/;
     module2.exports = send;
     module2.exports.mime = mime;
-    function send(req, path17, options) {
-      return new SendStream(req, path17, options);
+    function send(req, path18, options) {
+      return new SendStream(req, path18, options);
     }
-    function SendStream(req, path17, options) {
+    function SendStream(req, path18, options) {
       Stream.call(this);
       var opts = options || {};
       this.options = opts;
-      this.path = path17;
+      this.path = path18;
       this.req = req;
       this._acceptRanges = opts.acceptRanges !== void 0 ? Boolean(opts.acceptRanges) : true;
       this._cacheControl = opts.cacheControl !== void 0 ? Boolean(opts.cacheControl) : true;
@@ -19335,8 +19335,8 @@ var require_send = __commonJS({
       this._index = index2;
       return this;
     }, "send.index: pass index as option");
-    SendStream.prototype.root = function root(path17) {
-      this._root = resolve10(String(path17));
+    SendStream.prototype.root = function root(path18) {
+      this._root = resolve10(String(path18));
       debug("root %s", this._root);
       return this;
     };
@@ -19449,10 +19449,10 @@ var require_send = __commonJS({
       var lastModified = this.res.getHeader("Last-Modified");
       return parseHttpDate(lastModified) <= parseHttpDate(ifRange);
     };
-    SendStream.prototype.redirect = function redirect(path17) {
+    SendStream.prototype.redirect = function redirect(path18) {
       var res = this.res;
       if (hasListeners(this, "directory")) {
-        this.emit("directory", res, path17);
+        this.emit("directory", res, path18);
         return;
       }
       if (this.hasTrailingSlash()) {
@@ -19472,42 +19472,42 @@ var require_send = __commonJS({
     SendStream.prototype.pipe = function pipe(res) {
       var root = this._root;
       this.res = res;
-      var path17 = decode(this.path);
-      if (path17 === -1) {
+      var path18 = decode(this.path);
+      if (path18 === -1) {
         this.error(400);
         return res;
       }
-      if (~path17.indexOf("\0")) {
+      if (~path18.indexOf("\0")) {
         this.error(400);
         return res;
       }
       var parts;
       if (root !== null) {
-        if (path17) {
-          path17 = normalize("." + sep3 + path17);
+        if (path18) {
+          path18 = normalize("." + sep3 + path18);
         }
-        if (UP_PATH_REGEXP.test(path17)) {
-          debug('malicious path "%s"', path17);
+        if (UP_PATH_REGEXP.test(path18)) {
+          debug('malicious path "%s"', path18);
           this.error(403);
           return res;
         }
-        parts = path17.split(sep3);
-        path17 = normalize(join12(root, path17));
+        parts = path18.split(sep3);
+        path18 = normalize(join13(root, path18));
       } else {
-        if (UP_PATH_REGEXP.test(path17)) {
-          debug('malicious path "%s"', path17);
+        if (UP_PATH_REGEXP.test(path18)) {
+          debug('malicious path "%s"', path18);
           this.error(403);
           return res;
         }
-        parts = normalize(path17).split(sep3);
-        path17 = resolve10(path17);
+        parts = normalize(path18).split(sep3);
+        path18 = resolve10(path18);
       }
       if (containsDotFile(parts)) {
         var access = this._dotfiles;
         if (access === void 0) {
           access = parts[parts.length - 1][0] === "." ? this._hidden ? "allow" : "ignore" : "allow";
         }
-        debug('%s dotfile "%s"', access, path17);
+        debug('%s dotfile "%s"', access, path18);
         switch (access) {
           case "allow":
             break;
@@ -19521,13 +19521,13 @@ var require_send = __commonJS({
         }
       }
       if (this._index.length && this.hasTrailingSlash()) {
-        this.sendIndex(path17);
+        this.sendIndex(path18);
         return res;
       }
-      this.sendFile(path17);
+      this.sendFile(path18);
       return res;
     };
-    SendStream.prototype.send = function send2(path17, stat) {
+    SendStream.prototype.send = function send2(path18, stat) {
       var len = stat.size;
       var options = this.options;
       var opts = {};
@@ -19539,9 +19539,9 @@ var require_send = __commonJS({
         this.headersAlreadySent();
         return;
       }
-      debug('pipe "%s"', path17);
-      this.setHeader(path17, stat);
-      this.type(path17);
+      debug('pipe "%s"', path18);
+      this.setHeader(path18, stat);
+      this.type(path18);
       if (this.isConditionalGET()) {
         if (this.isPreconditionFailure()) {
           this.error(412);
@@ -19590,26 +19590,26 @@ var require_send = __commonJS({
         res.end();
         return;
       }
-      this.stream(path17, opts);
+      this.stream(path18, opts);
     };
-    SendStream.prototype.sendFile = function sendFile(path17) {
+    SendStream.prototype.sendFile = function sendFile(path18) {
       var i = 0;
       var self = this;
-      debug('stat "%s"', path17);
-      fs17.stat(path17, function onstat(err, stat) {
-        if (err && err.code === "ENOENT" && !extname3(path17) && path17[path17.length - 1] !== sep3) {
+      debug('stat "%s"', path18);
+      fs17.stat(path18, function onstat(err, stat) {
+        if (err && err.code === "ENOENT" && !extname3(path18) && path18[path18.length - 1] !== sep3) {
           return next(err);
         }
         if (err) return self.onStatError(err);
-        if (stat.isDirectory()) return self.redirect(path17);
-        self.emit("file", path17, stat);
-        self.send(path17, stat);
+        if (stat.isDirectory()) return self.redirect(path18);
+        self.emit("file", path18, stat);
+        self.send(path18, stat);
       });
       function next(err) {
         if (self._extensions.length <= i) {
           return err ? self.onStatError(err) : self.error(404);
         }
-        var p = path17 + "." + self._extensions[i++];
+        var p = path18 + "." + self._extensions[i++];
         debug('stat "%s"', p);
         fs17.stat(p, function(err2, stat) {
           if (err2) return next(err2);
@@ -19619,7 +19619,7 @@ var require_send = __commonJS({
         });
       }
     };
-    SendStream.prototype.sendIndex = function sendIndex(path17) {
+    SendStream.prototype.sendIndex = function sendIndex(path18) {
       var i = -1;
       var self = this;
       function next(err) {
@@ -19627,7 +19627,7 @@ var require_send = __commonJS({
           if (err) return self.onStatError(err);
           return self.error(404);
         }
-        var p = join12(path17, self._index[i]);
+        var p = join13(path18, self._index[i]);
         debug('stat "%s"', p);
         fs17.stat(p, function(err2, stat) {
           if (err2) return next(err2);
@@ -19638,10 +19638,10 @@ var require_send = __commonJS({
       }
       next();
     };
-    SendStream.prototype.stream = function stream(path17, options) {
+    SendStream.prototype.stream = function stream(path18, options) {
       var self = this;
       var res = this.res;
-      var stream2 = fs17.createReadStream(path17, options);
+      var stream2 = fs17.createReadStream(path18, options);
       this.emit("stream", stream2);
       stream2.pipe(res);
       function cleanup() {
@@ -19656,10 +19656,10 @@ var require_send = __commonJS({
         self.emit("end");
       });
     };
-    SendStream.prototype.type = function type(path17) {
+    SendStream.prototype.type = function type(path18) {
       var res = this.res;
       if (res.getHeader("Content-Type")) return;
-      var type2 = mime.lookup(path17);
+      var type2 = mime.lookup(path18);
       if (!type2) {
         debug("no content-type");
         return;
@@ -19668,9 +19668,9 @@ var require_send = __commonJS({
       debug("content-type %s", type2);
       res.setHeader("Content-Type", type2 + (charset ? "; charset=" + charset : ""));
     };
-    SendStream.prototype.setHeader = function setHeader(path17, stat) {
+    SendStream.prototype.setHeader = function setHeader(path18, stat) {
       var res = this.res;
-      this.emit("headers", res, path17, stat);
+      this.emit("headers", res, path18, stat);
       if (this._acceptRanges && !res.getHeader("Accept-Ranges")) {
         debug("accept ranges");
         res.setHeader("Accept-Ranges", "bytes");
@@ -19729,9 +19729,9 @@ var require_send = __commonJS({
       }
       return err instanceof Error ? createError(status, err, { expose: false }) : createError(status, err);
     }
-    function decode(path17) {
+    function decode(path18) {
       try {
-        return decodeURIComponent(path17);
+        return decodeURIComponent(path18);
       } catch (err) {
         return -1;
       }
@@ -20641,10 +20641,10 @@ var require_utils2 = __commonJS({
     var querystring = require("querystring");
     exports2.etag = createETagGenerator({ weak: false });
     exports2.wetag = createETagGenerator({ weak: true });
-    exports2.isAbsolute = function(path16) {
-      if ("/" === path16[0]) return true;
-      if (":" === path16[1] && ("\\" === path16[2] || "/" === path16[2])) return true;
-      if ("\\\\" === path16.substring(0, 2)) return true;
+    exports2.isAbsolute = function(path17) {
+      if ("/" === path17[0]) return true;
+      if (":" === path17[1] && ("\\" === path17[2] || "/" === path17[2])) return true;
+      if ("\\\\" === path17.substring(0, 2)) return true;
     };
     exports2.flatten = deprecate.function(
       flatten,
@@ -20855,7 +20855,7 @@ var require_application = __commonJS({
     };
     app.use = function use(fn) {
       var offset = 0;
-      var path16 = "/";
+      var path17 = "/";
       if (typeof fn !== "function") {
         var arg = fn;
         while (Array.isArray(arg) && arg.length !== 0) {
@@ -20863,7 +20863,7 @@ var require_application = __commonJS({
         }
         if (typeof arg !== "function") {
           offset = 1;
-          path16 = fn;
+          path17 = fn;
         }
       }
       var fns = flatten(slice.call(arguments, offset));
@@ -20874,12 +20874,12 @@ var require_application = __commonJS({
       var router = this._router;
       fns.forEach(function(fn2) {
         if (!fn2 || !fn2.handle || !fn2.set) {
-          return router.use(path16, fn2);
+          return router.use(path17, fn2);
         }
-        debug(".use app under %s", path16);
-        fn2.mountpath = path16;
+        debug(".use app under %s", path17);
+        fn2.mountpath = path17;
         fn2.parent = this;
-        router.use(path16, function mounted_app(req, res, next) {
+        router.use(path17, function mounted_app(req, res, next) {
           var orig = req.app;
           fn2.handle(req, res, function(err) {
             setPrototypeOf(req, orig.request);
@@ -20891,9 +20891,9 @@ var require_application = __commonJS({
       }, this);
       return this;
     };
-    app.route = function route(path16) {
+    app.route = function route(path17) {
       this.lazyrouter();
-      return this._router.route(path16);
+      return this._router.route(path17);
     };
     app.engine = function engine(ext, fn) {
       if (typeof fn !== "function") {
@@ -20944,7 +20944,7 @@ var require_application = __commonJS({
       }
       return this;
     };
-    app.path = function path16() {
+    app.path = function path17() {
       return this.parent ? this.parent.path() + this.mountpath : "";
     };
     app.enabled = function enabled(setting) {
@@ -20960,19 +20960,19 @@ var require_application = __commonJS({
       return this.set(setting, false);
     };
     methods.forEach(function(method) {
-      app[method] = function(path16) {
+      app[method] = function(path17) {
         if (method === "get" && arguments.length === 1) {
-          return this.set(path16);
+          return this.set(path17);
         }
         this.lazyrouter();
-        var route = this._router.route(path16);
+        var route = this._router.route(path17);
         route[method].apply(route, slice.call(arguments, 1));
         return this;
       };
     });
-    app.all = function all(path16) {
+    app.all = function all(path17) {
       this.lazyrouter();
-      var route = this._router.route(path16);
+      var route = this._router.route(path17);
       var args = slice.call(arguments, 1);
       for (var i = 0; i < methods.length; i++) {
         route[methods[i]].apply(route, args);
@@ -21731,7 +21731,7 @@ var require_request = __commonJS({
       var subdomains2 = !isIP(hostname2) ? hostname2.split(".").reverse() : [hostname2];
       return subdomains2.slice(offset);
     });
-    defineGetter(req, "path", function path16() {
+    defineGetter(req, "path", function path17() {
       return parse(this).pathname;
     });
     defineGetter(req, "hostname", function hostname2() {
@@ -22054,7 +22054,7 @@ var require_response = __commonJS({
     var http2 = require("http");
     var isAbsolute2 = require_utils2().isAbsolute;
     var onFinished = require_on_finished();
-    var path16 = require("path");
+    var path17 = require("path");
     var statuses = require_statuses();
     var merge = require_utils_merge();
     var sign = require_cookie_signature().sign;
@@ -22063,9 +22063,9 @@ var require_response = __commonJS({
     var setCharset = require_utils2().setCharset;
     var cookie = require_cookie();
     var send = require_send();
-    var extname3 = path16.extname;
+    var extname3 = path17.extname;
     var mime = send.mime;
-    var resolve10 = path16.resolve;
+    var resolve10 = path17.resolve;
     var vary = require_vary();
     var res = Object.create(http2.ServerResponse.prototype);
     module2.exports = res;
@@ -22242,26 +22242,26 @@ var require_response = __commonJS({
       this.type("txt");
       return this.send(body);
     };
-    res.sendFile = function sendFile(path17, options, callback) {
+    res.sendFile = function sendFile(path18, options, callback) {
       var done = callback;
       var req = this.req;
       var res2 = this;
       var next = req.next;
       var opts = options || {};
-      if (!path17) {
+      if (!path18) {
         throw new TypeError("path argument is required to res.sendFile");
       }
-      if (typeof path17 !== "string") {
+      if (typeof path18 !== "string") {
         throw new TypeError("path must be a string to res.sendFile");
       }
       if (typeof options === "function") {
         done = options;
         opts = {};
       }
-      if (!opts.root && !isAbsolute2(path17)) {
+      if (!opts.root && !isAbsolute2(path18)) {
         throw new TypeError("path must be absolute or specify root to res.sendFile");
       }
-      var pathname = encodeURI(path17);
+      var pathname = encodeURI(path18);
       var file = send(req, pathname, opts);
       sendfile(res2, file, opts, function(err) {
         if (done) return done(err);
@@ -22271,7 +22271,7 @@ var require_response = __commonJS({
         }
       });
     };
-    res.sendfile = function(path17, options, callback) {
+    res.sendfile = function(path18, options, callback) {
       var done = callback;
       var req = this.req;
       var res2 = this;
@@ -22281,7 +22281,7 @@ var require_response = __commonJS({
         done = options;
         opts = {};
       }
-      var file = send(req, path17, opts);
+      var file = send(req, path18, opts);
       sendfile(res2, file, opts, function(err) {
         if (done) return done(err);
         if (err && err.code === "EISDIR") return next();
@@ -22294,7 +22294,7 @@ var require_response = __commonJS({
       res.sendfile,
       "res.sendfile: Use res.sendFile instead"
     );
-    res.download = function download(path17, filename, options, callback) {
+    res.download = function download(path18, filename, options, callback) {
       var done = callback;
       var name = filename;
       var opts = options || null;
@@ -22311,7 +22311,7 @@ var require_response = __commonJS({
         opts = filename;
       }
       var headers = {
-        "Content-Disposition": contentDisposition(name || path17)
+        "Content-Disposition": contentDisposition(name || path18)
       };
       if (opts && opts.headers) {
         var keys = Object.keys(opts.headers);
@@ -22324,7 +22324,7 @@ var require_response = __commonJS({
       }
       opts = Object.create(opts);
       opts.headers = headers;
-      var fullPath = !opts.root ? resolve10(path17) : path17;
+      var fullPath = !opts.root ? resolve10(path18) : path18;
       return this.sendFile(fullPath, opts, done);
     };
     res.contentType = res.type = function contentType(type) {
@@ -22625,11 +22625,11 @@ var require_serve_static = __commonJS({
         }
         var forwardError = !fallthrough;
         var originalUrl = parseUrl.original(req);
-        var path16 = parseUrl(req).pathname;
-        if (path16 === "/" && originalUrl.pathname.substr(-1) !== "/") {
-          path16 = "";
+        var path17 = parseUrl(req).pathname;
+        if (path17 === "/" && originalUrl.pathname.substr(-1) !== "/") {
+          path17 = "";
         }
-        var stream = send(req, path16, opts);
+        var stream = send(req, path17, opts);
         stream.on("directory", onDirectory);
         if (setHeaders) {
           stream.on("headers", setHeaders);
@@ -22771,9 +22771,12 @@ __export(main_exports, {
   DEFAULT_CONFIG: () => DEFAULT_CONFIG3,
   DEFAULT_NODE_NAME: () => DEFAULT_NODE_NAME,
   DEFAULT_NODE_PORT: () => DEFAULT_NODE_PORT,
+  applyStartMetadata: () => applyStartMetadata,
   createDefaultConfig: () => createDefaultConfig,
   createRuntimeDefaultConfig: () => createRuntimeDefaultConfig,
+  ensureStartupRequirements: () => ensureStartupRequirements,
   formatBanner: () => formatBanner,
+  formatLoadedStartMetadata: () => formatLoadedStartMetadata,
   getDefaultNodeName: () => getDefaultNodeName,
   isDirectRunPath: () => isDirectRunPath,
   loadConfigFile: () => loadConfigFile,
@@ -22781,12 +22784,14 @@ __export(main_exports, {
   mergeConfig: () => mergeConfig,
   parseArgs: () => parseArgs,
   promptStartOptions: () => promptStartOptions,
-  shouldPromptForStartOptions: () => shouldPromptForStartOptions
+  resolveRuntimeAuthMetadata: () => resolveRuntimeAuthMetadata,
+  resolveStartupRequirementsMetadata: () => resolveStartupRequirementsMetadata,
+  shouldCollectStartOptions: () => shouldCollectStartOptions,
+  shouldPromptForStartOptions: () => shouldPromptForStartOptions,
+  shouldSkipStartupRequirementsCheck: () => shouldSkipStartupRequirementsCheck
 });
 module.exports = __toCommonJS(main_exports);
-var fs16 = __toESM(require("fs"), 1);
 var nodePath = __toESM(require("path"), 1);
-var readline = __toESM(require("readline/promises"), 1);
 
 // ../../packages/core/src/logger.ts
 var fs = __toESM(require("fs"), 1);
@@ -22810,18 +22815,19 @@ function hourlyFolder(date) {
 var FileWriter = class {
   constructor(logDir, component, clock) {
     this.logDir = logDir;
-    this.component = component;
     this.clock = clock;
+    this.fileName = component.replace(/[/\\]/g, "-");
   }
   currentFolder = "";
   currentStream = null;
+  fileName;
   write(chunk) {
     const folder = hourlyFolder(this.clock());
     if (folder !== this.currentFolder) {
       this.currentStream?.end();
       const dir = path.join(this.logDir, folder);
       fs.mkdirSync(dir, { recursive: true });
-      const filePath = path.join(dir, `${this.component}.log`);
+      const filePath = path.join(dir, `${this.fileName}.log`);
       this.currentStream = fs.createWriteStream(filePath, { flags: "a" });
       this.currentFolder = folder;
     }
@@ -22856,6 +22862,12 @@ var MeshyLogger = class _MeshyLogger {
     this.log("error", msg, data);
   }
   child(component) {
+    if (this.state.logDir) {
+      const fileWriter = new FileWriter(this.state.logDir, component, this.state.clock);
+      const writer = this.state.consoleEnabled ? new MultiWriter([process.stdout, fileWriter]) : fileWriter;
+      const childState = { ...this.state, writer };
+      return new _MeshyLogger(childState, component);
+    }
     return new _MeshyLogger(this.state, component);
   }
   log(level, msg, data) {
@@ -22912,7 +22924,9 @@ function createLogger(options = {}) {
     level: options.level ?? "info",
     nodeId: options.nodeId,
     clock,
-    writer
+    writer,
+    logDir: options.logDir,
+    consoleEnabled: options.console
   };
   return new MeshyRootLogger(state, options.component);
 }
@@ -22996,10 +23010,14 @@ function getTaskInitialMessageContent(task) {
   return normalizeTaskUserMessageContent(task.description || task.title);
 }
 
+// ../../packages/core/src/azure-cli-auth.ts
+var import_node_child_process = require("child_process");
+
 // ../../packages/core/src/node-metadata.ts
 var fs2 = __toESM(require("fs"), 1);
 var os = __toESM(require("os"), 1);
 var path2 = __toESM(require("path"), 1);
+var STARTUP_TRANSPORTS = /* @__PURE__ */ new Set(["direct", "devtunnel", "tailscale"]);
 function getDeviceNodeName() {
   return os.hostname();
 }
@@ -23026,8 +23044,59 @@ function writeNodeMetadata(storagePath, metadata) {
   fs2.mkdirSync(storagePath, { recursive: true });
   fs2.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2) + "\n", "utf-8");
 }
+function normalizeAllowedUsers(allowedUsers) {
+  if (!Array.isArray(allowedUsers)) {
+    return [];
+  }
+  const unique = /* @__PURE__ */ new Set();
+  for (const user of allowedUsers) {
+    if (typeof user !== "string") continue;
+    const normalized = user.trim().toLowerCase();
+    if (normalized.length > 0) {
+      unique.add(normalized);
+    }
+  }
+  return [...unique];
+}
+function normalizeAuthMetadata(auth) {
+  return {
+    enabled: auth?.enabled === true,
+    allowSameTenant: auth?.allowSameTenant === true,
+    allowedUsers: normalizeAllowedUsers(auth?.allowedUsers)
+  };
+}
+function normalizePositiveInteger(value) {
+  if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
+    return void 0;
+  }
+  return value;
+}
+function normalizeString(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function normalizeStartupTransport(value) {
+  return typeof value === "string" && STARTUP_TRANSPORTS.has(value) ? value : void 0;
+}
+function normalizeStartupMetadata(startup) {
+  return {
+    port: normalizePositiveInteger(startup?.port),
+    transport: normalizeStartupTransport(startup?.transport),
+    join: normalizeString(startup?.join),
+    workDir: normalizeString(startup?.workDir)
+  };
+}
+function hasStartupValues(startup) {
+  return startup.port !== void 0 || startup.transport !== void 0 || startup.join !== void 0 || startup.workDir !== void 0;
+}
+function resolvePersistedDefaultNodeName(storagePath) {
+  return normalizeString(readNodeMetadata(storagePath).defaultNodeName);
+}
 function resolveDefaultNodeName(storagePath, deviceName = getDeviceNodeName()) {
-  const preferredName = readNodeMetadata(storagePath).defaultNodeName?.trim();
+  const preferredName = resolvePersistedDefaultNodeName(storagePath);
   return preferredName && preferredName.length > 0 ? preferredName : deviceName;
 }
 function persistDefaultNodeName(storagePath, name, deviceName = getDeviceNodeName()) {
@@ -23040,6 +23109,46 @@ function persistDefaultNodeName(storagePath, name, deviceName = getDeviceNodeNam
   }
   writeNodeMetadata(storagePath, metadata);
 }
+function resolveNodeAuthMetadata(storagePath) {
+  return normalizeAuthMetadata(readNodeMetadata(storagePath).auth);
+}
+function resolveNodeStartupMetadata(storagePath) {
+  return normalizeStartupMetadata(readNodeMetadata(storagePath).startup);
+}
+function hasPersistedNodeStartupMetadata(storagePath) {
+  return hasStartupValues(resolveNodeStartupMetadata(storagePath));
+}
+function persistNodeAuthMetadata(storagePath, auth) {
+  const metadata = readNodeMetadata(storagePath);
+  const normalized = normalizeAuthMetadata(auth);
+  if (!normalized.enabled && !normalized.allowSameTenant && normalized.allowedUsers.length === 0) {
+    delete metadata.auth;
+  } else {
+    metadata.auth = {
+      enabled: normalized.enabled,
+      allowSameTenant: normalized.allowSameTenant,
+      allowedUsers: normalized.allowedUsers
+    };
+  }
+  writeNodeMetadata(storagePath, metadata);
+}
+function persistNodeStartupMetadata(storagePath, startup) {
+  const metadata = readNodeMetadata(storagePath);
+  const normalized = normalizeStartupMetadata(startup);
+  if (!hasStartupValues(normalized)) {
+    delete metadata.startup;
+  } else {
+    metadata.startup = normalized;
+  }
+  writeNodeMetadata(storagePath, metadata);
+}
+function persistNodeStartupTransport(storagePath, transport) {
+  const startup = resolveNodeStartupMetadata(storagePath);
+  persistNodeStartupMetadata(storagePath, {
+    ...startup,
+    transport
+  });
+}
 function resolvePersistedDevTunnelId(storagePath, kind) {
   return readNodeMetadata(storagePath).devTunnelIds?.[kind]?.trim() || void 0;
 }
@@ -23072,6 +23181,246 @@ function resolveOrCreateDevTunnelId(storagePath, nodeId, kind) {
   return generatedId;
 }
 
+// ../../packages/core/src/azure-cli-auth.ts
+var DEFAULT_AZ_RESOURCE = process.env.MESHY_AZ_TOKEN_RESOURCE?.trim() || "https://management.azure.com/";
+var TOKEN_REFRESH_SKEW_MS = 6e4;
+function summarizeClaims(claims) {
+  return {
+    tid: claims.tid,
+    oid: claims.oid,
+    preferred_username: claims.preferred_username,
+    upn: claims.upn,
+    email: claims.email,
+    aud: claims.aud
+  };
+}
+function decodeAzureCliJwtClaims(token) {
+  const parts = token.split(".");
+  if (parts.length < 2) {
+    throw new Error("Token is not a JWT");
+  }
+  const payload = parts[1];
+  if (!payload) {
+    throw new Error("JWT payload is empty");
+  }
+  const normalized = payload.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(payload.length / 4) * 4, "=");
+  const parsed = JSON.parse(Buffer.from(normalized, "base64").toString("utf-8"));
+  if (!parsed || typeof parsed !== "object") {
+    throw new Error("JWT payload is not an object");
+  }
+  return parsed;
+}
+function normalizeIdentityValue(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim().toLowerCase() : void 0;
+}
+function getIdentityValues(claims) {
+  const values = /* @__PURE__ */ new Set();
+  for (const candidate of [
+    claims.oid,
+    claims.preferred_username,
+    claims.upn,
+    claims.email,
+    claims.unique_name,
+    claims.sub
+  ]) {
+    const normalized = normalizeIdentityValue(candidate);
+    if (normalized) {
+      values.add(normalized);
+    }
+  }
+  return values;
+}
+function parseExpiry(value) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return value > 1e10 ? value : value * 1e3;
+  }
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    if (trimmed.length === 0) {
+      throw new Error("expiresOn is empty");
+    }
+    if (/^\d+$/.test(trimmed)) {
+      const numeric = Number(trimmed);
+      return numeric > 1e10 ? numeric : numeric * 1e3;
+    }
+    const parsed = Date.parse(trimmed);
+    if (!Number.isNaN(parsed)) {
+      return parsed;
+    }
+  }
+  throw new Error("Unable to parse Azure CLI token expiry");
+}
+function getAzureCliCommandInvocation(command, args, platform = process.platform) {
+  if (platform !== "win32") {
+    return { command, args };
+  }
+  return {
+    command,
+    args,
+    shell: true
+  };
+}
+function defaultCommandRunner(command, args) {
+  const invocation = getAzureCliCommandInvocation(command, args);
+  const result = (0, import_node_child_process.spawnSync)(invocation.command, invocation.args, {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "pipe"],
+    shell: invocation.shell
+  });
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    const message = result.stderr?.trim() || `Azure CLI command exited with code ${result.status}`;
+    throw new Error(message);
+  }
+  return result.stdout;
+}
+var AzureCliNodeAuth = class {
+  constructor(storagePath, options = {}) {
+    this.storagePath = storagePath;
+    this.runCommand = options.commandRunner ?? defaultCommandRunner;
+    this.log = options.logger ?? { debug() {
+    }, info() {
+    }, warn() {
+    }, error() {
+    }, child() {
+      return this;
+    } };
+    this.resource = options.resource?.trim() || DEFAULT_AZ_RESOURCE;
+    this.settingsProvider = options.settingsProvider;
+  }
+  runCommand;
+  log;
+  resource;
+  settingsProvider;
+  cachedToken = null;
+  getSettings() {
+    return this.settingsProvider?.() ?? resolveNodeAuthMetadata(this.storagePath);
+  }
+  isEnabled() {
+    return this.getSettings().enabled;
+  }
+  getAuthorizationHeaders() {
+    if (!this.isEnabled()) {
+      return {};
+    }
+    const token = this.getAccessToken();
+    return {
+      authorization: `Bearer ${token.accessToken}`
+    };
+  }
+  validateAuthorizationHeader(header) {
+    if (!this.isEnabled()) {
+      return { ok: true, reason: "disabled" };
+    }
+    if (typeof header !== "string") {
+      return { ok: false, reason: "missing" };
+    }
+    const token = header.startsWith("Bearer ") ? header.slice("Bearer ".length).trim() : "";
+    if (!token) {
+      return { ok: false, reason: "missing" };
+    }
+    let peerClaims;
+    try {
+      peerClaims = decodeAzureCliJwtClaims(token);
+    } catch {
+      return { ok: false, reason: "invalid" };
+    }
+    const local = this.getAccessToken();
+    const settings = this.getSettings();
+    if (isPeerIdentityAllowed(peerClaims, local.claims, settings)) {
+      return {
+        ok: true,
+        reason: "match",
+        localClaims: local.claims,
+        peerClaims
+      };
+    }
+    return {
+      ok: false,
+      reason: "mismatch",
+      localClaims: local.claims,
+      peerClaims
+    };
+  }
+  getAccessToken() {
+    if (this.cachedToken && this.cachedToken.expiresAtMs - TOKEN_REFRESH_SKEW_MS > Date.now()) {
+      this.log.debug("using cached azure cli access token", {
+        resource: this.resource,
+        expiresAt: new Date(this.cachedToken.expiresAtMs).toISOString(),
+        expiresInMs: this.cachedToken.expiresAtMs - Date.now(),
+        claims: summarizeClaims(this.cachedToken.claims)
+      });
+      return this.cachedToken;
+    }
+    this.log.info("requesting azure cli access token", {
+      resource: this.resource,
+      cachedTokenPresent: this.cachedToken !== null
+    });
+    let raw;
+    try {
+      raw = this.runCommand("az", [
+        "account",
+        "get-access-token",
+        "--resource",
+        this.resource,
+        "--output",
+        "json"
+      ]);
+    } catch (error) {
+      this.log.error("failed to execute az account get-access-token", {
+        resource: this.resource,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      throw error;
+    }
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.accessToken !== "string" || parsed.accessToken.trim().length === 0) {
+      this.log.error("azure cli token response did not include accessToken", {
+        resource: this.resource
+      });
+      throw new Error("Azure CLI did not return accessToken");
+    }
+    const expiresAtMs = parseExpiry(parsed.expiresOn ?? parsed.expires_on);
+    const claims = decodeAzureCliJwtClaims(parsed.accessToken);
+    this.cachedToken = {
+      accessToken: parsed.accessToken,
+      expiresAtMs,
+      claims
+    };
+    this.log.info("received azure cli access token", {
+      resource: this.resource,
+      expiresAt: new Date(expiresAtMs).toISOString(),
+      expiresInMs: expiresAtMs - Date.now(),
+      claims: summarizeClaims(claims)
+    });
+    return this.cachedToken;
+  }
+};
+function isPeerIdentityAllowed(peerClaims, localClaims, settings) {
+  const peerIdentities = getIdentityValues(peerClaims);
+  const localIdentities = getIdentityValues(localClaims);
+  for (const identity of peerIdentities) {
+    if (localIdentities.has(identity)) {
+      return true;
+    }
+  }
+  for (const allowedUser of settings.allowedUsers) {
+    if (peerIdentities.has(allowedUser)) {
+      return true;
+    }
+  }
+  if (settings.allowSameTenant) {
+    const peerTenant = normalizeIdentityValue(peerClaims.tid);
+    const localTenant = normalizeIdentityValue(localClaims.tid);
+    if (peerTenant && localTenant && peerTenant === localTenant) {
+      return true;
+    }
+  }
+  return false;
+}
+
 // ../../packages/core/src/file-store.ts
 var fs3 = __toESM(require("fs"), 1);
 var path3 = __toESM(require("path"), 1);
@@ -23516,6 +23865,7 @@ function parseNodeInfo(value) {
     lastHeartbeat: value.lastHeartbeat,
     transportType: typeof value.transportType === "string" ? value.transportType : void 0,
     devtunnelEndpoint: typeof value.devtunnelEndpoint === "string" ? value.devtunnelEndpoint : void 0,
+    dashboardOrigin: typeof value.dashboardOrigin === "string" ? value.dashboardOrigin : void 0,
     previewOrigin: typeof value.previewOrigin === "string" ? value.previewOrigin : void 0
   };
 }
@@ -23595,6 +23945,38 @@ var EventBus = class {
   }
 };
 
+// ../../packages/core/src/request-auth.ts
+var requestAuthHeadersProvider = null;
+function normalizeHeaders(headers) {
+  if (!headers) {
+    return {};
+  }
+  if (headers instanceof Headers) {
+    return Object.fromEntries(headers.entries());
+  }
+  if (Array.isArray(headers)) {
+    return Object.fromEntries(headers);
+  }
+  return Object.fromEntries(
+    Object.entries(headers).flatMap(
+      ([key, value]) => value === void 0 ? [] : [[key, String(value)]]
+    )
+  );
+}
+function setRequestAuthHeadersProvider(provider) {
+  requestAuthHeadersProvider = provider;
+}
+function applyRequestAuthHeaders(init = {}) {
+  const headers = normalizeHeaders(init.headers);
+  if (!Object.keys(headers).some((key) => key.toLowerCase() === "authorization") && requestAuthHeadersProvider) {
+    Object.assign(headers, requestAuthHeadersProvider());
+  }
+  return {
+    ...init,
+    headers
+  };
+}
+
 // ../../packages/core/src/node-endpoints.ts
 var DEFAULT_NODE_REQUEST_TIMEOUT_MS = 1500;
 function getNodePublicEndpoint(node) {
@@ -23623,22 +24005,27 @@ function createRequestSignal(signal, timeoutMs) {
 async function fetchWithTimeout(url, init, timeoutMs = DEFAULT_NODE_REQUEST_TIMEOUT_MS) {
   const { cleanup, signal } = createRequestSignal(init?.signal, timeoutMs);
   try {
-    return await fetch(url, {
+    return await fetch(url, applyRequestAuthHeaders({
       ...init,
       signal
-    });
+    }));
   } finally {
     cleanup();
   }
 }
-async function fetchNodeWithFallback(node, path16, init, timeoutMs = DEFAULT_NODE_REQUEST_TIMEOUT_MS) {
+async function fetchNodeWithFallback(node, path17, init, timeoutMs = DEFAULT_NODE_REQUEST_TIMEOUT_MS, trace) {
   let lastError;
-  for (const endpoint of getNodeRequestEndpoints(node)) {
+  const endpoints = getNodeRequestEndpoints(node);
+  for (const [index, endpoint] of endpoints.entries()) {
+    const attempt = index + 1;
+    trace?.onAttempt?.({ attempt, endpoint, path: path17, timeoutMs, totalEndpoints: endpoints.length });
     try {
-      const response = await fetchWithTimeout(`${endpoint}${path16}`, init, timeoutMs);
+      const response = await fetchWithTimeout(`${endpoint}${path17}`, init, timeoutMs);
+      trace?.onResponse?.({ attempt, endpoint, path: path17, response, timeoutMs, totalEndpoints: endpoints.length });
       return { endpoint, response };
     } catch (error) {
       lastError = error;
+      trace?.onError?.({ attempt, endpoint, error, path: path17, timeoutMs, totalEndpoints: endpoints.length });
     }
   }
   throw lastError instanceof Error ? lastError : new Error("No reachable node endpoint");
@@ -23746,6 +24133,24 @@ var NodeRegistry = class {
       }
     }
   }
+  updateDashboardOrigin(id, dashboardOrigin) {
+    const node = this.nodes.get(id);
+    if (node) {
+      if (dashboardOrigin) {
+        node.dashboardOrigin = dashboardOrigin;
+      } else {
+        delete node.dashboardOrigin;
+      }
+      this.store.upsertNode(node);
+    }
+    if (this.selfNode && this.selfNode.id === id) {
+      if (dashboardOrigin) {
+        this.selfNode.dashboardOrigin = dashboardOrigin;
+      } else {
+        delete this.selfNode.dashboardOrigin;
+      }
+    }
+  }
   updatePreviewOrigin(id, previewOrigin) {
     const node = this.nodes.get(id);
     if (node) {
@@ -23935,15 +24340,18 @@ var LeaderElection = class {
     if (announce.term < this.currentTerm) {
       return;
     }
-    if (announce.term > this.currentTerm) {
-      this.currentTerm = announce.term;
-    }
-    this.leader = false;
-    this.nodeRegistry.setLeader(announce.leaderId, announce.term);
-    this.eventBus.emit("election.complete", {
-      leaderId: announce.leaderId,
-      term: announce.term
-    });
+    this.adoptLeader(announce);
+  }
+  /**
+   * Explicit cluster joins are operator-driven reconfiguration, not normal
+   * election traffic. Force the local node to follow the joined leader even
+   * if this node previously incremented its term while detached.
+   */
+  adoptLeaderFromJoin(announce) {
+    this.currentTerm = announce.term;
+    this.votedForTerm = announce.term;
+    this.votedForCandidate = announce.leaderId;
+    this.adoptLeader(announce);
   }
   // ── Leader Lease ─────────────────────────────────────────────────────
   isLeader() {
@@ -23955,6 +24363,18 @@ var LeaderElection = class {
   stepDown() {
     this.leader = false;
   }
+  /**
+   * Adopt local leadership without running an election.
+   * Used when a follower explicitly detaches from a leader and becomes
+   * a solo node immediately.
+   */
+  assumeLeadership() {
+    const self = this.nodeRegistry.getSelf();
+    this.currentTerm = Math.max(this.currentTerm, 1);
+    this.votedForTerm = this.currentTerm;
+    this.votedForCandidate = self.id;
+    this.becomeLeader();
+  }
   /** Manually promote this node to leader. */
   async promote() {
     const self = this.nodeRegistry.getSelf();
@@ -23992,6 +24412,15 @@ var LeaderElection = class {
       term: this.currentTerm
     });
   }
+  adoptLeader(announce) {
+    this.currentTerm = announce.term;
+    this.leader = false;
+    this.nodeRegistry.setLeader(announce.leaderId, announce.term);
+    this.eventBus.emit("election.complete", {
+      leaderId: announce.leaderId,
+      term: announce.term
+    });
+  }
   async broadcastAnnounce(leaderId, term) {
     const self = this.nodeRegistry.getSelf();
     const onlineNodes = this.nodeRegistry.getOnlineNodes().filter(
@@ -24000,11 +24429,11 @@ var LeaderElection = class {
     const announcePromises = onlineNodes.map(async (node) => {
       try {
         const endpoint = getNodePublicEndpoint(node);
-        await fetch(`${endpoint}/api/worker/announce`, {
+        await fetch(`${endpoint}/api/worker/announce`, applyRequestAuthHeaders({
           method: "POST",
           headers: { "Content-Type": "application/json" },
           body: JSON.stringify({ leaderId, term })
-        });
+        }));
       } catch {
       }
     });
@@ -24593,6 +25022,12 @@ function listWorkDirFolders(workDir) {
 
 // ../../packages/core/src/heartbeat.ts
 var MISSED_HEARTBEAT_THRESHOLD = 3;
+function formatError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function truncateForLog(value, max = 240) {
+  return !value || value.length <= max ? value : `${value.slice(0, max - 3)}...`;
+}
 var HeartbeatMonitor = class {
   constructor(nodeRegistry, election, eventBus, config, logger) {
     this.nodeRegistry = nodeRegistry;
@@ -24770,10 +25205,40 @@ var HeartbeatMonitor = class {
     };
     const promises2 = followers.map(async (node) => {
       try {
-        const { response } = await fetchNodeWithFallback(node, "/api/worker/heartbeat", {
+        const { endpoint, response } = await fetchNodeWithFallback(node, "/api/worker/heartbeat", {
           method: "POST",
           headers: { "Content-Type": "application/json" },
           body: JSON.stringify(request)
+        }, void 0, {
+          onAttempt: ({ attempt, endpoint: targetEndpoint, totalEndpoints, timeoutMs }) => {
+            this.log.info("sending heartbeat request", {
+              nodeId: node.id,
+              endpoint: targetEndpoint,
+              attempt,
+              totalEndpoints,
+              timeoutMs,
+              term: request.term
+            });
+          },
+          onError: ({ attempt, endpoint: targetEndpoint, error, totalEndpoints }) => {
+            this.log.warn("heartbeat request attempt failed", {
+              nodeId: node.id,
+              endpoint: targetEndpoint,
+              attempt,
+              totalEndpoints,
+              error: formatError(error)
+            });
+          },
+          onResponse: ({ attempt, endpoint: targetEndpoint, response: heartbeatResponse, totalEndpoints }) => {
+            this.log.info("heartbeat response received", {
+              nodeId: node.id,
+              endpoint: targetEndpoint,
+              attempt,
+              totalEndpoints,
+              ok: heartbeatResponse.ok,
+              statusCode: heartbeatResponse.status
+            });
+          }
         });
         if (response.ok) {
           const result = await response.json();
@@ -24782,6 +25247,7 @@ var HeartbeatMonitor = class {
           this.nodeRegistry.updateHeartbeat(node.id, Date.now());
           this.nodeRegistry.updateLoad(node.id, result.load);
           this.applyReportedDevTunnelState(node.id, result.devtunnelEnabled, result.devtunnelEndpoint);
+          this.nodeRegistry.updateDashboardOrigin(node.id, result.dashboardOrigin);
           this.nodeRegistry.updatePreviewOrigin(node.id, result.previewOrigin);
           if (result.workDirFolders) {
             this.nodeRegistry.updateFolders(node.id, result.workDirFolders);
@@ -24789,11 +25255,27 @@ var HeartbeatMonitor = class {
           if (result.status !== node.status) {
             this.nodeRegistry.updateStatus(node.id, result.status);
           }
+          this.log.info("heartbeat response applied", {
+            nodeId: node.id,
+            endpoint,
+            reportedStatus: result.status,
+            load: result.load,
+            workDirFolders: result.workDirFolders?.length ?? 0
+          });
           return;
         }
-        this.recordFollowerMiss(node);
-      } catch {
-        this.recordFollowerMiss(node);
+        const body = truncateForLog(await response.text().catch(() => void 0));
+        this.recordFollowerMiss(node, {
+          endpoint,
+          reason: "non-ok heartbeat response",
+          statusCode: response.status,
+          body
+        });
+      } catch (error) {
+        this.recordFollowerMiss(node, {
+          reason: "heartbeat request threw",
+          error: formatError(error)
+        });
       }
     });
     await Promise.all(promises2);
@@ -24817,7 +25299,7 @@ var HeartbeatMonitor = class {
       term: req.term,
       nodeCount: req.clusterState.nodes.length
     });
-    return {
+    const response = {
       nodeId: self.id,
       status: self.status,
       runningTasks: [],
@@ -24825,9 +25307,11 @@ var HeartbeatMonitor = class {
       load: 0,
       devtunnelEnabled: self.devtunnelEndpoint !== void 0,
       devtunnelEndpoint: self.devtunnelEndpoint,
+      dashboardOrigin: self.dashboardOrigin,
       previewOrigin: self.previewOrigin,
       workDirFolders: self.workDir ? listWorkDirFolders(self.workDir) : void 0
     };
+    return response;
   }
   // ── Leader: handle keepalive from follower ──────────────────────────
   handleKeepalive(req) {
@@ -24842,6 +25326,7 @@ var HeartbeatMonitor = class {
       workDir,
       devtunnelEnabled,
       devtunnelEndpoint,
+      dashboardOrigin,
       previewOrigin,
       workDirFolders
     } = req;
@@ -24850,7 +25335,6 @@ var HeartbeatMonitor = class {
     const normalizedEndpoint = endpoint ?? existingNode?.endpoint ?? devtunnelEndpoint ?? "";
     const normalizedCapabilities = capabilities ?? existingNode?.capabilities ?? [];
     const currentCapabilities = existingNode?.capabilities ?? [];
-    this.log.debug("keepalive received", { nodeId, status });
     this.followerMissedMap.set(nodeId, 0);
     let node = existingNode;
     const now = Date.now();
@@ -24867,6 +25351,7 @@ var HeartbeatMonitor = class {
         ...transportType ? { transportType } : {},
         ...workDir ? { workDir } : {},
         ...devtunnelEnabled && devtunnelEndpoint ? { devtunnelEndpoint } : {},
+        ...dashboardOrigin ? { dashboardOrigin } : {},
         ...previewOrigin ? { previewOrigin } : {},
         ...workDirFolders ? { workDirFolders } : {}
       });
@@ -24900,6 +25385,7 @@ var HeartbeatMonitor = class {
     }
     this.nodeRegistry.updateLoad(nodeId, load);
     this.applyReportedDevTunnelState(nodeId, devtunnelEnabled, devtunnelEndpoint);
+    this.nodeRegistry.updateDashboardOrigin(nodeId, dashboardOrigin);
     this.nodeRegistry.updatePreviewOrigin(nodeId, previewOrigin);
     if (workDirFolders) {
       this.nodeRegistry.updateFolders(nodeId, workDirFolders);
@@ -24915,7 +25401,7 @@ var HeartbeatMonitor = class {
     if (controlRequests.length > 0) {
       this.queuedControlRequests.delete(nodeId);
     }
-    return {
+    const response = {
       leaderId: self.id,
       term: this.election.getCurrentTerm(),
       timestamp: Date.now(),
@@ -24927,6 +25413,7 @@ var HeartbeatMonitor = class {
       followUpMessages: followUpMessages.length > 0 ? followUpMessages : void 0,
       controlRequests: controlRequests.length > 0 ? controlRequests : void 0
     };
+    return response;
   }
   // ── Follower: send keepalive to leader ──────────────────────────────
   async sendKeepalive() {
@@ -24947,18 +25434,33 @@ var HeartbeatMonitor = class {
       workDir: self.workDir,
       devtunnelEnabled: self.devtunnelEndpoint !== void 0,
       devtunnelEndpoint: self.devtunnelEndpoint,
+      dashboardOrigin: self.dashboardOrigin,
       previewOrigin: self.previewOrigin,
       workDirFolders: self.workDir ? listWorkDirFolders(self.workDir) : void 0
     };
+    this.log.info("sending keepalive request", {
+      nodeId: self.id,
+      leaderEndpoint,
+      status: self.status,
+      workDirFolders: request.workDirFolders?.length ?? 0,
+      devtunnelEnabled: request.devtunnelEnabled
+    });
     try {
-      const response = await fetch(`${leaderEndpoint}/api/worker/keepalive`, {
+      const response = await fetch(`${leaderEndpoint}/api/worker/keepalive`, applyRequestAuthHeaders({
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify(request)
-      });
+      }));
       if (response.ok) {
         const result = await response.json();
-        this.log.debug("keepalive ok", { nodes: result.clusterState.nodes.length });
+        this.log.info("keepalive response received", {
+          leaderId: result.leaderId,
+          term: result.term,
+          nodeCount: result.clusterState.nodes.length,
+          dispatchedTaskCount: result.dispatchedTasks?.length ?? 0,
+          followUpCount: result.followUpMessages?.length ?? 0,
+          controlRequestCount: result.controlRequests?.length ?? 0
+        });
         this.lastHeartbeatTime = Date.now();
         this.missedCount = 0;
         this.nodeRegistry.setLeader(result.leaderId, result.term);
@@ -24988,10 +25490,17 @@ var HeartbeatMonitor = class {
           ));
         }
       } else {
-        this.log.warn("keepalive failed", { status: response.status, leaderEndpoint });
+        this.log.warn("keepalive request returned non-ok response", {
+          leaderEndpoint,
+          statusCode: response.status,
+          body: truncateForLog(await response.text().catch(() => void 0))
+        });
       }
     } catch (err) {
-      this.log.warn("keepalive error", { error: err instanceof Error ? err.message : String(err) });
+      this.log.warn("keepalive request failed", {
+        leaderEndpoint,
+        error: formatError(err)
+      });
     }
   }
   // ── Accessors ───────────────────────────────────────────────────────
@@ -25004,13 +25513,30 @@ var HeartbeatMonitor = class {
   canPushToNode(nodeId) {
     const node = this.nodeRegistry.getNode(nodeId);
     if (!node) return false;
-    if (node.devtunnelEndpoint) return true;
-    return this.followerEverReachedMap.get(nodeId) ?? false;
+    if (node.status === "offline") return false;
+    return !!(node.devtunnelEndpoint || node.endpoint);
   }
   // ── Private helpers ─────────────────────────────────────────────────
   startLeaderMode() {
     this.heartbeatTimer = setInterval(() => {
-      void this.sendHeartbeat();
+      const self = this.nodeRegistry.getSelf();
+      if (self.workDir) {
+        this.nodeRegistry.updateFolders(self.id, listWorkDirFolders(self.workDir));
+      }
+      const now = Date.now();
+      const followers = this.nodeRegistry.getAllNodes().filter((node) => node.id !== self.id);
+      for (const node of followers) {
+        if (node.status === "offline") continue;
+        const elapsed = now - node.lastHeartbeat;
+        if (elapsed >= this.config.electionTimeout) {
+          this.log.warn("marking node offline from stale follower keepalive", {
+            nodeId: node.id,
+            lastHeartbeat: node.lastHeartbeat,
+            elapsed
+          });
+          this.nodeRegistry.updateStatus(node.id, "offline");
+        }
+      }
     }, this.config.heartbeatInterval);
   }
   startFollowerMode() {
@@ -25044,10 +25570,21 @@ var HeartbeatMonitor = class {
       }
     }, this.config.electionTimeout);
   }
-  recordFollowerMiss(node) {
+  recordFollowerMiss(node, details) {
     const current = this.followerMissedMap.get(node.id) ?? 0;
     const newCount = current + 1;
     this.followerMissedMap.set(node.id, newCount);
+    const everReached = this.followerEverReachedMap.get(node.id) ?? false;
+    this.log.warn("recorded heartbeat miss", {
+      nodeId: node.id,
+      misses: newCount,
+      everReached,
+      endpoint: details.endpoint,
+      statusCode: details.statusCode,
+      reason: details.reason,
+      error: details.error,
+      body: details.body
+    });
     if (newCount >= MISSED_HEARTBEAT_THRESHOLD) {
       const freshNode = this.nodeRegistry.getNode(node.id);
       if (freshNode) {
@@ -25056,13 +25593,20 @@ var HeartbeatMonitor = class {
           this.log.debug("miss threshold but lastHeartbeat recent \u2014 skip offline", {
             nodeId: node.id,
             elapsed,
-            everReached: this.followerEverReachedMap.get(node.id) ?? false
+            everReached
           });
           return;
         }
       }
-      const everReached = this.followerEverReachedMap.get(node.id) ?? false;
-      this.log.warn("marking node offline", { nodeId: node.id, everReached, misses: newCount });
+      this.log.warn("marking node offline", {
+        nodeId: node.id,
+        everReached,
+        misses: newCount,
+        endpoint: details.endpoint,
+        statusCode: details.statusCode,
+        reason: details.reason,
+        error: details.error
+      });
       this.nodeRegistry.updateStatus(node.id, "offline");
     }
   }
@@ -25125,11 +25669,11 @@ var HeartbeatMonitor = class {
       }
     }
     try {
-      const res = await fetch(`${leaderEndpoint}/api/worker/control-response`, {
+      const res = await fetch(`${leaderEndpoint}/api/worker/control-response`, applyRequestAuthHeaders({
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify(response)
-      });
+      }));
       if (!res.ok) {
         this.log.warn("leader rejected control response", {
           requestId: request.requestId,
@@ -25174,9 +25718,9 @@ var DataRouter = class {
   /**
    * Returns true if the request should be proxied to the leader.
    */
-  shouldProxy(method, path16) {
+  shouldProxy(method, path17) {
     if (this.election.isLeader()) return false;
-    if (this.isExcludedPath(path16)) return false;
+    if (this.isExcludedPath(path17)) return false;
     if (method.toUpperCase() === "GET") return false;
     return WRITE_METHODS.has(method.toUpperCase());
   }
@@ -25219,12 +25763,12 @@ var DataRouter = class {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this.config.proxyTimeout);
     try {
-      const response = await fetch(targetUrl, {
+      const response = await fetch(targetUrl, applyRequestAuthHeaders({
         method,
         headers: forwardHeaders,
         body,
         signal: controller.signal
-      });
+      }));
       const responseHeaders = {};
       response.headers.forEach((value, key) => {
         responseHeaders[key] = value;
@@ -25277,8 +25821,8 @@ var DataRouter = class {
     };
   }
   // ── Helpers ───────────────────────────────────────────────────────────
-  isExcludedPath(path16) {
-    return EXCLUDED_PATH_PREFIXES.some((prefix) => path16.startsWith(prefix)) || EXCLUDED_PATH_SUFFIXES.some((suffix) => path16.endsWith(suffix));
+  isExcludedPath(path17) {
+    return EXCLUDED_PATH_PREFIXES.some((prefix) => path17.startsWith(prefix)) || EXCLUDED_PATH_SUFFIXES.some((suffix) => path17.endsWith(suffix));
   }
 };
 
@@ -25418,11 +25962,11 @@ function forwardLeaderTaskPatch(log, nodeRegistry, taskId, data, options) {
     log.warn(options.missingLeaderMessage, metadata);
     return;
   }
-  fetch(`${leaderEndpoint}/api/tasks/${taskId}`, {
+  fetch(`${leaderEndpoint}/api/tasks/${taskId}`, applyRequestAuthHeaders({
     method: "PATCH",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(buildLeaderTaskPatch(data))
-  }).then((response) => {
+  })).then((response) => {
     if (!response.ok) {
       log.warn(options.rejectedMessage, {
         ...metadata,
@@ -25469,11 +26013,11 @@ function forwardTaskOutputToLeader(log, nodeRegistry, taskId, event) {
     });
     return;
   }
-  fetch(`${leaderEndpoint}/api/worker/output`, {
+  fetch(`${leaderEndpoint}/api/worker/output`, applyRequestAuthHeaders({
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ taskId, event })
-  }).then((response) => {
+  })).then((response) => {
     if (!response.ok) {
       log.warn("leader rejected forwarded output", {
         taskId,
@@ -25541,7 +26085,7 @@ function registerLeaderForwarding(eventBus, nodeRegistry, log, taskId, agent) {
 // ../../packages/core/src/engines/claude-code-engine.ts
 var fs7 = __toESM(require("fs"), 1);
 var path7 = __toESM(require("path"), 1);
-var import_node_child_process = require("child_process");
+var import_node_child_process2 = require("child_process");
 function resolveClaudeInvocation() {
   if (process.platform !== "win32") {
     return { command: "claude", argsPrefix: [] };
@@ -25603,7 +26147,7 @@ var ClaudeCodeEngine = class extends ExecutionEngine {
     this.ensureLogDir();
     this.logger.info("Spawning claude CLI", { taskId: task.id, title: task.title, cwd });
     const invocation = resolveClaudeInvocation();
-    const proc = (0, import_node_child_process.spawn)(invocation.command, [...invocation.argsPrefix, ...args], {
+    const proc = (0, import_node_child_process2.spawn)(invocation.command, [...invocation.argsPrefix, ...args], {
       cwd,
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -25713,7 +26257,7 @@ var ClaudeCodeEngine = class extends ExecutionEngine {
       "stream-json"
     ];
     const invocation = resolveClaudeInvocation();
-    const proc = (0, import_node_child_process.spawn)(invocation.command, [...invocation.argsPrefix, ...args], {
+    const proc = (0, import_node_child_process2.spawn)(invocation.command, [...invocation.argsPrefix, ...args], {
       cwd: session.cwd,
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -25848,7 +26392,7 @@ var ClaudeCodeEngine = class extends ExecutionEngine {
 // ../../packages/core/src/engines/codex-engine.ts
 var fs8 = __toESM(require("fs"), 1);
 var path8 = __toESM(require("path"), 1);
-var import_node_child_process2 = require("child_process");
+var import_node_child_process3 = require("child_process");
 function buildAssistantEvent(text, timestamp = (/* @__PURE__ */ new Date()).toISOString()) {
   return {
     type: "assistant",
@@ -25907,7 +26451,7 @@ var CodexEngine = class extends ExecutionEngine {
     const args = this.buildArgs(prompt, imagePaths, { model: config.model });
     this.ensureLogDir();
     this.logger.info("Spawning codex CLI", { taskId: task.id, title: task.title, cwd });
-    const proc = (0, import_node_child_process2.spawn)("codex", args, {
+    const proc = (0, import_node_child_process3.spawn)("codex", args, {
       cwd,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -25934,7 +26478,7 @@ var CodexEngine = class extends ExecutionEngine {
     const { prompt, imagePaths } = this.prepareAssets(taskId, content);
     const args = this.buildArgs(prompt, imagePaths, { model, sessionId: session.sessionId });
     this.logger.info("Sending Codex follow-up message", { taskId, sessionId: session.sessionId });
-    const proc = (0, import_node_child_process2.spawn)("codex", args, {
+    const proc = (0, import_node_child_process3.spawn)("codex", args, {
       cwd: session.cwd,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -26290,23 +26834,53 @@ ${joinErrors.map((e) => `  - ${e}`).join("\n")}`
     this.started = true;
   }
   async joinCluster(seedUrl) {
+    const log = this.logger.child("node/join-cluster");
+    const tasks = this.taskEngine.listTasks().tasks;
     const joinBody = {
       id: this.selfInfo.id,
       endpoint: this.selfInfo.endpoint,
       name: this.config.node.name,
       capabilities: [],
-      tasks: this.taskEngine.listTasks().tasks
+      tasks
     };
     if (this.selfInfo.devtunnelEndpoint) {
       joinBody.devtunnelEndpoint = this.selfInfo.devtunnelEndpoint;
     }
-    const response = await fetch(`${seedUrl}/api/cluster/join`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(joinBody)
+    log.info("sending cluster join request", {
+      seedUrl,
+      nodeId: this.selfInfo.id,
+      endpoint: this.selfInfo.endpoint,
+      taskCount: tasks.length,
+      hasDevTunnel: !!this.selfInfo.devtunnelEndpoint
+    });
+    let response;
+    try {
+      response = await fetch(`${seedUrl}/api/cluster/join`, applyRequestAuthHeaders({
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(joinBody)
+      }));
+    } catch (error) {
+      log.warn("cluster join request failed", {
+        seedUrl,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      throw error;
+    }
+    log.info("received cluster join response", {
+      seedUrl,
+      ok: response.ok,
+      statusCode: response.status
     });
     if (!response.ok) {
       const body = await response.json?.().catch(() => null);
+      log.warn("cluster join request rejected", {
+        seedUrl,
+        statusCode: response.status,
+        code: body?.error?.code,
+        message: body?.error?.message,
+        leaderEndpoint: body?.error?.leaderEndpoint
+      });
       if (body?.error?.code === "NOT_LEADER") {
         const leader = body.error.leaderEndpoint;
         throw new Error(
@@ -26316,22 +26890,51 @@ ${joinErrors.map((e) => `  - ${e}`).join("\n")}`
       throw new Error(`Failed to join cluster via ${seedUrl}: ${response.status}`);
     }
     const data = await response.json();
+    log.info("applied joined cluster state", {
+      seedUrl,
+      leaderId: data.leaderId,
+      term: data.term,
+      nodeCount: data.nodes.length
+    });
     this.applyClusterState(data.nodes, data.leaderId, data.term);
   }
   async leaveCluster() {
+    const log = this.logger.child("node/leave-cluster");
     const leader = this.nodeRegistry.getLeader();
     const leaderEndpoint = this.nodeRegistry.getLeaderEndpoint();
     const self = this.nodeRegistry.getSelf();
     if (!leader || !leaderEndpoint || leader.id === self.id) {
+      log.info("skipping cluster leave request", {
+        hasLeader: !!leader,
+        leaderEndpoint,
+        selfId: self.id
+      });
       return;
     }
     try {
-      await fetch(`${leaderEndpoint}/api/cluster/leave`, {
+      log.info("sending cluster leave request", {
+        leaderId: leader.id,
+        leaderEndpoint,
+        nodeId: self.id
+      });
+      const response = await fetch(`${leaderEndpoint}/api/cluster/leave`, applyRequestAuthHeaders({
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ nodeId: self.id })
+      }));
+      log.info("received cluster leave response", {
+        leaderId: leader.id,
+        leaderEndpoint,
+        ok: response.ok,
+        statusCode: response.status
+      });
+    } catch (error) {
+      log.warn("cluster leave request failed", {
+        leaderId: leader.id,
+        leaderEndpoint,
+        nodeId: self.id,
+        error: error instanceof Error ? error.message : String(error)
       });
-    } catch {
     }
     const refreshedSelf = {
       ...self,
@@ -26344,8 +26947,13 @@ ${joinErrors.map((e) => `  - ${e}`).join("\n")}`
     this.nodeRegistry.setSelf(refreshedSelf);
     this.nodeRegistry.syncFromHeartbeat([refreshedSelf]);
     this.nodeRegistry.clearLeader();
-    this.election.stepDown();
-    await this.election.startElection();
+    this.election.assumeLeadership();
+    this.syncSelfInfoFromRegistry();
+    log.info("detached from leader and assumed solo leadership", {
+      previousLeaderId: leader.id,
+      nodeId: refreshedSelf.id,
+      term: this.election.getCurrentTerm()
+    });
   }
   async stop() {
     if (!this.started) return;
@@ -26355,13 +26963,26 @@ ${joinErrors.map((e) => `  - ${e}`).join("\n")}`
     try {
       const leaderEndpoint = this.nodeRegistry.getLeaderEndpoint();
       if (leaderEndpoint) {
-        await fetch(`${leaderEndpoint}/api/cluster/leave`, {
+        this.logger.info("sending shutdown cluster leave request", {
+          leaderEndpoint,
+          nodeId: this.selfInfo.id
+        });
+        const response = await fetch(`${leaderEndpoint}/api/cluster/leave`, applyRequestAuthHeaders({
           method: "POST",
           headers: { "Content-Type": "application/json" },
           body: JSON.stringify({ nodeId: this.selfInfo.id })
+        }));
+        this.logger.info("received shutdown cluster leave response", {
+          leaderEndpoint,
+          ok: response.ok,
+          statusCode: response.status
         });
       }
-    } catch {
+    } catch (error) {
+      this.logger.warn("shutdown cluster leave request failed", {
+        nodeId: this.selfInfo.id,
+        error: error instanceof Error ? error.message : String(error)
+      });
     }
     if (this.devtunnelTransport) {
       await this.devtunnelTransport.stop();
@@ -26440,11 +27061,11 @@ ${joinErrors.map((e) => `  - ${e}`).join("\n")}`
       const leaderEndpoint = this.nodeRegistry.getLeaderEndpoint();
       if (leaderEndpoint && !this.nodeRegistry.isLeader()) {
         try {
-          await fetch(`${leaderEndpoint}/api/nodes/${this.selfInfo.id}`, {
+          await fetch(`${leaderEndpoint}/api/nodes/${this.selfInfo.id}`, applyRequestAuthHeaders({
             method: "PATCH",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify({ endpoint: newEndpoint })
-          });
+          }));
         } catch {
         }
       }
@@ -26522,7 +27143,7 @@ ${joinErrors.map((e) => `  - ${e}`).join("\n")}`
     this.selfInfo = nextSelf;
     this.nodeRegistry.setSelf(nextSelf);
     this.nodeRegistry.syncFromHeartbeat(nodes);
-    this.election.handleLeaderAnnounce({ leaderId, term });
+    this.election.adoptLeaderFromJoin({ leaderId, term });
   }
   cloneTransportConfig(config) {
     return {
@@ -27161,8 +27782,8 @@ function getErrorMap() {
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path16, errorMaps, issueData } = params;
-  const fullPath = [...path16, ...issueData.path || []];
+  const { data, path: path17, errorMaps, issueData } = params;
+  const fullPath = [...path17, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -27278,11 +27899,11 @@ var errorUtil;
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path16, key) {
+  constructor(parent, value, path17, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path16;
+    this._path = path17;
     this._key = key;
   }
   get path() {
@@ -30752,6 +31373,7 @@ var NodeInfoSchema = external_exports.object({
   lastHeartbeat: external_exports.number(),
   transportType: external_exports.string().optional(),
   devtunnelEndpoint: external_exports.string().optional(),
+  dashboardOrigin: external_exports.string().optional(),
   previewOrigin: external_exports.string().optional()
 });
 var JoinTaskSchema = external_exports.object({
@@ -30821,6 +31443,7 @@ var NodeInfoSchema2 = external_exports.object({
   lastHeartbeat: external_exports.number(),
   transportType: external_exports.string().optional(),
   devtunnelEndpoint: external_exports.string().optional(),
+  dashboardOrigin: external_exports.string().optional(),
   previewOrigin: external_exports.string().optional()
 });
 var NodeListQuery = external_exports.object({
@@ -30947,13 +31570,113 @@ var import_express7 = __toESM(require_express2(), 1);
 
 // ../../packages/api/src/middleware/auth.ts
 var SKIP_AUTH_PATHS = ["/api/system/health"];
+var TRUSTED_LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+function normalizeHost(value) {
+  if (!value) return void 0;
+  const trimmed = value.trim().toLowerCase();
+  if (!trimmed) return void 0;
+  return trimmed.replace(/:\d+$/, "");
+}
+function collectHosts(candidates) {
+  const unique = /* @__PURE__ */ new Set();
+  for (const candidate of candidates) {
+    if (!candidate) continue;
+    for (const item of candidate.split(",")) {
+      const normalized = normalizeHost(item);
+      if (normalized) {
+        unique.add(normalized);
+      }
+    }
+  }
+  return [...unique];
+}
+function getForwardedHosts(req) {
+  const forwardedHosts = collectHosts([
+    typeof req.headers["x-forwarded-host"] === "string" ? req.headers["x-forwarded-host"] : void 0
+  ]);
+  if (forwardedHosts.length > 0) {
+    return forwardedHosts;
+  }
+  const forwardedHeader = typeof req.headers.forwarded === "string" ? req.headers.forwarded : void 0;
+  if (!forwardedHeader) {
+    return [];
+  }
+  const forwardedMatches = [...forwardedHeader.matchAll(/host=([^;,\s]+)/gi)];
+  return collectHosts(forwardedMatches.map((match) => match[1]?.replace(/^"|"$/g, "")));
+}
+function getDirectHosts(req) {
+  return collectHosts([
+    req.hostname,
+    typeof req.headers.host === "string" ? req.headers.host : void 0
+  ]);
+}
+function getRequestHosts(req) {
+  const forwardedHosts = getForwardedHosts(req);
+  if (forwardedHosts.length > 0) {
+    return forwardedHosts;
+  }
+  return getDirectHosts(req);
+}
+function isTrustedDashboardRequest(req, config) {
+  const trustedHosts = new Set((config.getTrustedHosts?.() ?? []).map((host) => normalizeHost(host)).filter(Boolean));
+  for (const host of getRequestHosts(req)) {
+    if (TRUSTED_LOCAL_HOSTS.has(host) || trustedHosts.has(host)) {
+      return true;
+    }
+  }
+  return false;
+}
+function getAuthLogger(req) {
+  const logger = req.app?.locals?.deps?.logger;
+  if (logger && typeof logger.child === "function") {
+    return logger.child("api/auth");
+  }
+  return {
+    debug() {
+    },
+    warn() {
+    }
+  };
+}
 function createAuthMiddleware(config) {
   return (req, _res, next) => {
-    if (!config.apiKey) {
+    const log = getAuthLogger(req);
+    if (SKIP_AUTH_PATHS.includes(req.path)) {
       next();
       return;
     }
-    if (SKIP_AUTH_PATHS.includes(req.path)) {
+    if (config.validateBearerToken) {
+      if (isTrustedDashboardRequest(req, config)) {
+        log.debug("skipping bearer auth for trusted dashboard request", {
+          path: req.path,
+          method: req.method,
+          hosts: getRequestHosts(req)
+        });
+        next();
+        return;
+      }
+      const result = config.validateBearerToken(req.headers.authorization);
+      if (!result.ok) {
+        log.warn("rejected bearer-authenticated request", {
+          path: req.path,
+          method: req.method,
+          hosts: getRequestHosts(req),
+          reason: result.reason
+        });
+        throw new MeshyError("VALIDATION_ERROR", "Invalid or missing bearer token", 401, {
+          reason: result.reason
+        });
+      }
+      log.debug("accepted bearer-authenticated request", {
+        path: req.path,
+        method: req.method,
+        hosts: getRequestHosts(req),
+        reason: result.reason
+      });
+      next();
+      return;
+    }
+    if (!config.apiKey) {
       next();
       return;
     }
@@ -31055,19 +31778,31 @@ function createErrorMiddleware() {
 // ../../packages/api/src/routes/cluster.ts
 var import_express = __toESM(require_express2(), 1);
 var CONNECTIVITY_TIMEOUT_MS = 8e3;
-async function verifyHealth(endpoint) {
+function formatError2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function verifyHealth(endpoint, log) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), CONNECTIVITY_TIMEOUT_MS);
+  const url = `${endpoint}/api/system/health`;
   try {
-    const response = await fetch(`${endpoint}/api/system/health`, {
+    log.info("sending leader health check", { endpoint, url, timeoutMs: CONNECTIVITY_TIMEOUT_MS });
+    const response = await fetch(url, {
       signal: controller.signal
     });
+    log.info("received leader health check response", {
+      endpoint,
+      url,
+      ok: response.ok,
+      statusCode: response.status
+    });
     if (!response.ok) {
       throw new Error(`health check returned ${response.status}`);
     }
   } catch (err) {
+    log.warn("leader health check failed", { endpoint, url, error: formatError2(err) });
     throw new Error(
-      `Failed to verify connectivity for ${endpoint}: ${err instanceof Error ? err.message : String(err)}`
+      `Failed to verify connectivity for ${endpoint}: ${formatError2(err)}`
     );
   } finally {
     clearTimeout(timer);
@@ -31079,9 +31814,11 @@ function asyncHandler(fn) {
 function createClusterRoutes() {
   const router = (0, import_express.Router)();
   router.post("/join", asyncHandler(async (req, res) => {
-    const { nodeRegistry, election, taskEngine } = req.app.locals.deps;
+    const { nodeRegistry, election, taskEngine, logger: rootLogger } = req.app.locals.deps;
+    const log = rootLogger.child("cluster/join");
     if (!election.isLeader()) {
       const leaderEndpoint = nodeRegistry.getLeaderEndpoint();
+      log.warn("rejected cluster join because node is not leader", { leaderEndpoint });
       res.status(421).json({
         error: {
           code: "NOT_LEADER",
@@ -31092,10 +31829,19 @@ function createClusterRoutes() {
       return;
     }
     const body = JoinClusterBody.parse(req.body);
+    log.info("received cluster join request", {
+      nodeId: body.id,
+      name: body.name,
+      endpoint: body.endpoint,
+      taskCount: body.tasks?.length ?? 0,
+      hasDevTunnel: !!body.devtunnelEndpoint
+    });
     const existingNodes = nodeRegistry.getAllNodes();
+    let removedCount = 0;
     for (const existing of existingNodes) {
       if (existing.id === body.id || existing.endpoint === body.endpoint || existing.name === body.name) {
         nodeRegistry.removeNode(existing.id);
+        removedCount++;
       }
     }
     const node = {
@@ -31111,6 +31857,12 @@ function createClusterRoutes() {
     };
     nodeRegistry.addNode(node);
     taskEngine.importTasks(body.tasks ?? []);
+    log.info("accepted cluster join request", {
+      nodeId: node.id,
+      endpoint: node.endpoint,
+      removedCount,
+      importedTaskCount: body.tasks?.length ?? 0
+    });
     const clusterState = nodeRegistry.getClusterState();
     res.status(201).json({
       clusterId: clusterState.clusterId ?? nanoid(),
@@ -31122,14 +31874,22 @@ function createClusterRoutes() {
   router.post("/connect", asyncHandler(async (req, res) => {
     const {
       nodeRegistry,
-      joinCurrentNodeToCluster
+      joinCurrentNodeToCluster,
+      logger: rootLogger
     } = req.app.locals.deps;
+    const log = rootLogger.child("cluster/connect");
     const body = ConnectClusterBody.parse(req.body);
+    log.info("received cluster connect request", {
+      leaderEndpoint: body.leaderEndpoint,
+      transport: body.transport
+    });
     if (!joinCurrentNodeToCluster) {
       throw new MeshyError("VALIDATION_ERROR", "Join flow is not available on this node", 501);
     }
-    await verifyHealth(body.leaderEndpoint);
+    await verifyHealth(body.leaderEndpoint, log);
+    log.info("leader health check succeeded", { leaderEndpoint: body.leaderEndpoint });
     await joinCurrentNodeToCluster(body.leaderEndpoint);
+    log.info("completed cluster connect request", { leaderEndpoint: body.leaderEndpoint });
     const self = nodeRegistry.getSelf();
     const clusterState = nodeRegistry.getClusterState();
     res.json({
@@ -31142,17 +31902,22 @@ function createClusterRoutes() {
     });
   }));
   router.post("/leave", asyncHandler(async (req, res) => {
-    const { nodeRegistry } = req.app.locals.deps;
+    const { nodeRegistry, logger: rootLogger } = req.app.locals.deps;
+    const log = rootLogger.child("cluster/leave");
     const { nodeId } = req.body;
+    log.info("received cluster leave request", { nodeId });
     nodeRegistry.removeNode(nodeId);
     res.json({ ok: true });
   }));
   router.post("/disconnect", asyncHandler(async (req, res) => {
-    const { leaveCurrentCluster, nodeRegistry } = req.app.locals.deps;
+    const { leaveCurrentCluster, nodeRegistry, logger: rootLogger } = req.app.locals.deps;
+    const log = rootLogger.child("cluster/disconnect");
+    log.info("received cluster disconnect request");
     if (!leaveCurrentCluster) {
       throw new MeshyError("VALIDATION_ERROR", "Leave flow is not available on this node", 501);
     }
     await leaveCurrentCluster();
+    log.info("completed cluster disconnect request");
     const self = nodeRegistry.getSelf();
     const clusterState = nodeRegistry.getClusterState();
     res.json({
@@ -31645,10 +32410,10 @@ function readFileContent(root, relativePath) {
 }
 
 // ../../packages/api/src/output/git-diff.ts
-var import_node_child_process3 = require("child_process");
+var import_node_child_process4 = require("child_process");
 function git(args, cwd) {
   try {
-    return (0, import_node_child_process3.execFileSync)("git", ["-C", cwd, ...args], {
+    return (0, import_node_child_process4.execFileSync)("git", ["-C", cwd, ...args], {
       encoding: "utf-8",
       timeout: 1e4,
       stdio: ["pipe", "pipe", "pipe"]
@@ -31841,7 +32606,8 @@ async function executeWorkerControlRequest(deps, request) {
           return jsonResponse(request.requestId, 200, {
             ok: true,
             enabled: true,
-            devtunnelEndpoint
+            devtunnelEndpoint,
+            dashboardOrigin: deps.nodeRegistry.getSelf().dashboardOrigin
           });
         }
         if (!deps.disableDevTunnel) {
@@ -31850,7 +32616,8 @@ async function executeWorkerControlRequest(deps, request) {
         await deps.disableDevTunnel();
         return jsonResponse(request.requestId, 200, {
           ok: true,
-          enabled: false
+          enabled: false,
+          dashboardOrigin: deps.nodeRegistry.getSelf().dashboardOrigin
         });
       }
       case "task-cancel": {
@@ -32084,10 +32851,19 @@ function createNodeRoutes() {
       }
       if (enabled) {
         const devtunnelEndpoint = await enableDevTunnel();
-        res.json({ ok: true, enabled: true, devtunnelEndpoint });
+        res.json({
+          ok: true,
+          enabled: true,
+          devtunnelEndpoint,
+          dashboardOrigin: nodeRegistry.getSelf().dashboardOrigin
+        });
       } else {
         await disableDevTunnel();
-        res.json({ ok: true, enabled: false });
+        res.json({
+          ok: true,
+          enabled: false,
+          dashboardOrigin: nodeRegistry.getSelf().dashboardOrigin
+        });
       }
     } else {
       const node = nodeRegistry.getNode(targetId);
@@ -32126,6 +32902,7 @@ function createNodeRoutes() {
           if (result?.ok) {
             if (nodeRegistry.getNode(targetId)) {
               nodeRegistry.updateDevTunnelEndpoint(targetId, result.devtunnelEndpoint);
+              nodeRegistry.updateDashboardOrigin(targetId, result.dashboardOrigin);
             }
           }
           sendWorkerControlResponse(res, controlResponse);
@@ -32141,6 +32918,7 @@ function createNodeRoutes() {
       const updatedNode = nodeRegistry.getNode(targetId);
       if (updatedNode) {
         nodeRegistry.updateDevTunnelEndpoint(targetId, result.devtunnelEndpoint);
+        nodeRegistry.updateDashboardOrigin(targetId, result.dashboardOrigin);
       }
       res.json(result);
     }
@@ -33025,13 +33803,40 @@ function createWorkerRoutes() {
     res.json({ ok: true });
   }));
   router.post("/heartbeat", asyncHandler4(async (req, res) => {
-    const { heartbeat } = req.app.locals.deps;
-    const response = heartbeat.handleHeartbeat(req.body);
+    const { heartbeat, logger: rootLogger } = req.app.locals.deps;
+    const log = rootLogger.child("worker/heartbeat");
+    const body = req.body;
+    log.info("received worker heartbeat API call", {
+      leaderId: body.leaderId,
+      term: body.term,
+      nodeCount: body.clusterState?.nodes?.length ?? 0
+    });
+    const response = heartbeat.handleHeartbeat(body);
+    log.info("completed worker heartbeat API call", {
+      nodeId: response.nodeId,
+      status: response.status,
+      load: response.load
+    });
     res.json(response);
   }));
   router.post("/keepalive", asyncHandler4(async (req, res) => {
-    const { heartbeat } = req.app.locals.deps;
-    const response = heartbeat.handleKeepalive(req.body);
+    const { heartbeat, logger: rootLogger } = req.app.locals.deps;
+    const log = rootLogger.child("worker/keepalive");
+    const body = req.body;
+    log.info("received worker keepalive API call", {
+      nodeId: body.nodeId,
+      status: body.status,
+      endpoint: body.endpoint
+    });
+    const response = heartbeat.handleKeepalive(body);
+    log.info("completed worker keepalive API call", {
+      leaderId: response.leaderId,
+      term: response.term,
+      nodeCount: response.clusterState.nodes.length,
+      dispatchedTaskCount: response.dispatchedTasks?.length ?? 0,
+      followUpCount: response.followUpMessages?.length ?? 0,
+      controlRequestCount: response.controlRequests?.length ?? 0
+    });
     res.json(response);
   }));
   router.post("/vote", asyncHandler4(async (req, res) => {
@@ -33055,8 +33860,19 @@ function createWorkerRoutes() {
     res.json(payload);
   }));
   router.post("/control-response", asyncHandler4(async (req, res) => {
-    const { heartbeat } = req.app.locals.deps;
-    const handled = heartbeat.handleWorkerControlResponse?.(req.body) ?? false;
+    const { heartbeat, logger: rootLogger } = req.app.locals.deps;
+    const log = rootLogger.child("worker/control-response");
+    const body = req.body;
+    log.info("received worker control response API call", {
+      requestId: body.requestId,
+      ok: body.ok,
+      statusCode: body.statusCode
+    });
+    const handled = heartbeat.handleWorkerControlResponse?.(body) ?? false;
+    log.info("completed worker control response API call", {
+      requestId: body.requestId,
+      handled
+    });
     res.json({ ok: true, handled });
   }));
   return router;
@@ -33069,17 +33885,29 @@ function asyncHandler5(fn) {
 }
 function createSystemRoutes() {
   const router = (0, import_express5.Router)();
-  router.get("/health", asyncHandler5(async (_req, res) => {
+  router.get("/health", asyncHandler5(async (req, res) => {
+    const { logger: rootLogger } = req.app.locals.deps;
+    rootLogger.child("system/health").info("received system health API call", {
+      method: req.method,
+      path: req.originalUrl || req.url,
+      remoteAddress: req.ip || req.socket.remoteAddress
+    });
     res.json({ status: "ok", timestamp: Date.now() });
   }));
   router.get("/info", asyncHandler5(async (req, res) => {
-    const { nodeRegistry, getTransportType } = req.app.locals.deps;
+    const { nodeRegistry, getTransportType, config, dashboardOrigin } = req.app.locals.deps;
     const self = nodeRegistry.getSelf();
     res.json({
       ...self,
       version: "0.1.0",
       uptime: process.uptime(),
-      transportType: getTransportType?.() ?? "direct"
+      transportType: getTransportType?.() ?? "direct",
+      dashboardOrigin: dashboardOrigin ?? self.dashboardOrigin,
+      auth: config.authMetadata ?? {
+        enabled: false,
+        allowSameTenant: false,
+        allowedUsers: []
+      }
     });
   }));
   router.post("/transport", asyncHandler5(async (req, res) => {
@@ -33110,10 +33938,19 @@ function createSystemRoutes() {
     assertCanChangeNodeDevTunnel(taskEngine, nodeRegistry.getSelf().id);
     if (enabled) {
       const devtunnelEndpoint = await enableDevTunnel();
-      res.json({ ok: true, enabled: true, devtunnelEndpoint });
+      res.json({
+        ok: true,
+        enabled: true,
+        devtunnelEndpoint,
+        dashboardOrigin: nodeRegistry.getSelf().dashboardOrigin
+      });
     } else {
       await disableDevTunnel();
-      res.json({ ok: true, enabled: false });
+      res.json({
+        ok: true,
+        enabled: false,
+        dashboardOrigin: nodeRegistry.getSelf().dashboardOrigin
+      });
     }
   }));
   router.get("/metrics", asyncHandler5(async (req, res) => {
@@ -33243,13 +34080,39 @@ function createServer2(deps) {
   if (typeof deps.heartbeat.setControlRequestHandler === "function") {
     deps.heartbeat.setControlRequestHandler((request) => executeWorkerControlRequest(deps, request));
   }
+  const authConfig = {
+    apiKey: deps.config.apiKey,
+    validateBearerToken: deps.config.validateBearerToken,
+    getTrustedHosts: () => {
+      const trustedHosts = [];
+      if (deps.dashboardOrigin) {
+        try {
+          trustedHosts.push(new URL(deps.dashboardOrigin).host);
+        } catch {
+        }
+      }
+      return trustedHosts;
+    }
+  };
+  const isApiRequest = (req) => req.path === "/api" || req.path.startsWith("/api/");
+  const canServeDashboard = (req) => !deps.config.validateBearerToken || isTrustedDashboardRequest(req, authConfig);
   const runtimeBaseDir = resolveRuntimeBaseDir();
   const staticDir = resolveStaticDir(runtimeBaseDir);
   if (staticDir) {
-    app.use(import_express7.default.static(staticDir));
+    const staticMiddleware = import_express7.default.static(staticDir);
+    app.use((req, res, next) => {
+      if (isApiRequest(req)) {
+        next();
+        return;
+      }
+      if (!canServeDashboard(req)) {
+        res.status(404).type("text/plain").send("Not Found");
+        return;
+      }
+      staticMiddleware(req, res, next);
+    });
   }
   app.use(import_express7.default.json({ limit: JSON_BODY_LIMIT }));
-  const authConfig = { apiKey: deps.config.apiKey };
   app.use(createAuthMiddleware(authConfig));
   app.use(createRoutingMiddleware(deps.dataRouter));
   const largeBodyParser = import_express7.default.json({ limit: JSON_BODY_LIMIT_LARGE });
@@ -33262,7 +34125,15 @@ function createServer2(deps) {
   if (staticDir) {
     const indexPath = path15.join(staticDir, "index.html");
     if (fs15.existsSync(indexPath)) {
-      app.get("*", (_req, res) => {
+      app.get("*", (req, res, next) => {
+        if (isApiRequest(req)) {
+          next();
+          return;
+        }
+        if (!canServeDashboard(req)) {
+          res.status(404).type("text/plain").send("Not Found");
+          return;
+        }
         res.sendFile(indexPath);
       });
     }
@@ -33337,10 +34208,10 @@ var DirectTransport = class {
 };
 
 // ../../packages/transport/src/devtunnel.ts
-var import_node_child_process4 = require("child_process");
+var import_node_child_process5 = require("child_process");
 function isInstalled(cmd) {
   try {
-    (0, import_node_child_process4.execSync)(process.platform === "win32" ? `where ${cmd}` : `command -v ${cmd}`, { stdio: "pipe" });
+    (0, import_node_child_process5.execSync)(process.platform === "win32" ? `where ${cmd}` : `command -v ${cmd}`, { stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -33363,14 +34234,14 @@ var DevTunnelTransport = class {
       );
     }
     try {
-      (0, import_node_child_process4.execSync)("devtunnel user show", { stdio: "pipe" });
+      (0, import_node_child_process5.execSync)("devtunnel user show", { stdio: "pipe" });
     } catch {
       throw new Error(
         "Not logged in to devtunnel. Run: devtunnel user login"
       );
     }
     const hostArgs = this.buildHostArgs(localPort);
-    const child = (0, import_node_child_process4.spawn)("devtunnel", hostArgs, {
+    const child = (0, import_node_child_process5.spawn)("devtunnel", hostArgs, {
       stdio: ["pipe", "pipe", "pipe"]
     });
     this.process = child;
@@ -33475,7 +34346,7 @@ ${lines.join("")}`
       return void 0;
     }
     try {
-      (0, import_node_child_process4.execFileSync)("devtunnel", ["show", tunnelId], { stdio: "pipe" });
+      (0, import_node_child_process5.execFileSync)("devtunnel", ["show", tunnelId], { stdio: "pipe" });
       return tunnelId;
     } catch {
       const createArgs = ["create", tunnelId];
@@ -33483,7 +34354,7 @@ ${lines.join("")}`
         createArgs.push("-a");
       }
       try {
-        (0, import_node_child_process4.execFileSync)("devtunnel", createArgs, { stdio: "pipe" });
+        (0, import_node_child_process5.execFileSync)("devtunnel", createArgs, { stdio: "pipe" });
         return tunnelId;
       } catch (err) {
         throw new Error(
@@ -33498,7 +34369,7 @@ ${lines.join("")}`
       return;
     }
     try {
-      (0, import_node_child_process4.execFileSync)(
+      (0, import_node_child_process5.execFileSync)(
         "devtunnel",
         ["port", "create", tunnelId, "-p", String(localPort), "--protocol", "http"],
         { stdio: "pipe" }
@@ -33514,7 +34385,7 @@ ${lines.join("")}`
   }
   listTunnelPorts(tunnelId) {
     try {
-      const output = (0, import_node_child_process4.execFileSync)("devtunnel", ["port", "list", tunnelId, "-j"], { stdio: "pipe" });
+      const output = (0, import_node_child_process5.execFileSync)("devtunnel", ["port", "list", tunnelId, "-j"], { stdio: "pipe" });
       const parsed = JSON.parse(output.toString());
       const items = Array.isArray(parsed) ? parsed : parsed && typeof parsed === "object" && Array.isArray(parsed.ports) ? parsed.ports : parsed && typeof parsed === "object" && Array.isArray(parsed.value) ? parsed.value : [];
       return items.map((item) => getPortNumber(item)).filter((value) => value !== void 0);
@@ -33526,7 +34397,7 @@ ${lines.join("")}`
   }
   hasTunnelPort(tunnelId, localPort) {
     try {
-      (0, import_node_child_process4.execFileSync)(
+      (0, import_node_child_process5.execFileSync)(
         "devtunnel",
         ["port", "show", tunnelId, "-p", String(localPort), "-j"],
         { stdio: "pipe" }
@@ -33580,25 +34451,282 @@ function createTransport(config) {
   }
 }
 
-// src/main.ts
+// src/startup.ts
+var fs16 = __toESM(require("fs"), 1);
+var path16 = __toESM(require("path"), 1);
+var readline = __toESM(require("readline/promises"), 1);
+var import_node_child_process6 = require("child_process");
 function getDefaultNodeName() {
   return getDeviceNodeName();
 }
 var DEFAULT_NODE_NAME = getDefaultNodeName();
 var DEFAULT_NODE_PORT = 12345;
 var SUPPORTED_TRANSPORTS = ["direct", "devtunnel", "tailscale"];
+var STARTUP_REQUIREMENTS = ["az", "devtunnel", "claude", "codex"];
 function createDefaultConfig(storagePath = resolveDefaultStoragePath(), nodeName = DEFAULT_NODE_NAME) {
   return {
     node: { name: nodeName, port: DEFAULT_NODE_PORT },
     transport: { type: "direct" },
-    cluster: { seeds: [], heartbeatInterval: 3e3, electionTimeout: 9e3, apiKey: "" },
+    cluster: { seeds: [], heartbeatInterval: 12e3, electionTimeout: 36e3, apiKey: "" },
     storage: { path: storagePath }
   };
 }
 var DEFAULT_CONFIG3 = createDefaultConfig();
-function createRuntimeDefaultConfig(fileConfig) {
+function createRuntimeDefaultConfig(fileConfig, options = {}) {
   const storagePath = fileConfig.storage?.path ?? resolveDefaultStoragePath();
-  return createDefaultConfig(storagePath, resolveDefaultNodeName(storagePath));
+  const nodeName = options.ignorePersistedName ? getDeviceNodeName() : resolveDefaultNodeName(storagePath);
+  return createDefaultConfig(storagePath, nodeName);
+}
+function writeLine(stream, message = "") {
+  stream.write(`${message}
+`);
+}
+function createPromptSession(prompt) {
+  if (prompt) {
+    return {
+      ask: prompt,
+      close: async () => void 0
+    };
+  }
+  if (!shouldPromptForStartOptions()) {
+    return void 0;
+  }
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  return {
+    ask: (question) => rl.question(question),
+    close: async () => rl.close()
+  };
+}
+function createDefaultCommandRunner(platform) {
+  return (command, args, interactive = false) => {
+    const result = (0, import_node_child_process6.spawnSync)(command, args, {
+      encoding: "utf-8",
+      shell: platform === "win32",
+      stdio: interactive ? "inherit" : "pipe"
+    });
+    return {
+      ok: result.status === 0 && !result.error,
+      status: result.status,
+      stdout: typeof result.stdout === "string" ? result.stdout : "",
+      stderr: typeof result.stderr === "string" ? result.stderr : "",
+      error: result.error?.message
+    };
+  };
+}
+function getNodeMetadataPath2(storagePath) {
+  return path16.join(storagePath, "metadata.json");
+}
+function readStartupMetadataFile(storagePath) {
+  try {
+    const raw = JSON.parse(fs16.readFileSync(getNodeMetadataPath2(storagePath), "utf-8"));
+    return typeof raw === "object" && raw !== null ? raw : {};
+  } catch {
+    return {};
+  }
+}
+function writeStartupMetadataFile(storagePath, metadata) {
+  fs16.mkdirSync(storagePath, { recursive: true });
+  fs16.writeFileSync(getNodeMetadataPath2(storagePath), JSON.stringify(metadata, null, 2) + "\n", "utf-8");
+}
+function formatLocalDate(now) {
+  const year = now.getFullYear();
+  const month = String(now.getMonth() + 1).padStart(2, "0");
+  const day = String(now.getDate()).padStart(2, "0");
+  return `${year}-${month}-${day}`;
+}
+function isYesAnswer(value) {
+  const normalized = value.trim().toLowerCase();
+  return normalized === "y" || normalized === "yes";
+}
+async function confirm(ask, question) {
+  const answer = await ask(`${question} [y/N]: `);
+  return isYesAnswer(answer);
+}
+function isCommandAvailable(commandRunner, platform, command) {
+  const lookupCommand = platform === "win32" ? "where" : "which";
+  return commandRunner(lookupCommand, [command], false).ok;
+}
+function buildInstallCommand(requirement, platform) {
+  switch (requirement) {
+    case "az":
+      if (platform === "darwin") {
+        return { command: "brew", args: ["install", "azure-cli"] };
+      }
+      if (platform === "win32") {
+        return { command: "winget", args: ["install", "--exact", "--id", "Microsoft.AzureCLI"] };
+      }
+      return void 0;
+    case "devtunnel":
+      if (platform === "darwin") {
+        return { command: "brew", args: ["install", "--cask", "devtunnel"] };
+      }
+      if (platform === "win32") {
+        return { command: "winget", args: ["install", "--exact", "--id", "Microsoft.devtunnel"] };
+      }
+      return void 0;
+    case "claude":
+      if (platform === "darwin") {
+        return { command: "bash", args: ["-lc", "curl -fsSL https://claude.ai/install.sh | bash"] };
+      }
+      if (platform === "win32") {
+        return {
+          command: "powershell",
+          args: ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", "irm https://claude.ai/install.ps1 | iex"]
+        };
+      }
+      return void 0;
+    case "codex":
+      return { command: "npm", args: ["install", "-g", "@openai/codex"] };
+  }
+}
+function buildLoginCommand(requirement) {
+  if (requirement === "az") {
+    return { command: "az", args: ["login"] };
+  }
+  return { command: "devtunnel", args: ["user", "login"] };
+}
+function isAuthenticated(requirement, commandRunner) {
+  const command = requirement === "az" ? { command: "az", args: ["account", "show"] } : { command: "devtunnel", args: ["user", "show"] };
+  return commandRunner(command.command, command.args, false).ok;
+}
+function isRequirementSatisfied(requirement, status) {
+  if (!status || status.installed !== true || status.status !== "ok") {
+    return false;
+  }
+  if (requirement === "az" || requirement === "devtunnel") {
+    return status.authenticated === true;
+  }
+  return true;
+}
+function resolveStartupRequirementsMetadata(storagePath) {
+  const metadata = readStartupMetadataFile(storagePath).startupRequirements;
+  return metadata && typeof metadata === "object" ? metadata : {};
+}
+function shouldSkipStartupRequirementsCheck(storagePath, now = /* @__PURE__ */ new Date()) {
+  const metadata = resolveStartupRequirementsMetadata(storagePath);
+  if (metadata.lastCheckedOn !== formatLocalDate(now)) {
+    return false;
+  }
+  return STARTUP_REQUIREMENTS.every((requirement) => isRequirementSatisfied(requirement, metadata.components?.[requirement]));
+}
+async function ensureRequirementInstalled(requirement, platform, ask, commandRunner, stdout, stderr) {
+  if (isCommandAvailable(commandRunner, platform, requirement)) {
+    return { installed: true, status: "ok" };
+  }
+  if (!ask) {
+    writeLine(stderr, `Missing required component "${requirement}". Start in a TTY to install it automatically.`);
+    return { installed: false, status: "missing" };
+  }
+  const install = buildInstallCommand(requirement, platform);
+  if (!install) {
+    writeLine(stderr, `Missing required component "${requirement}", and automatic install is not supported on ${platform}.`);
+    return { installed: false, status: "unsupported-platform" };
+  }
+  if (!await confirm(ask, `Required component "${requirement}" is missing. Install it now?`)) {
+    return { installed: false, status: "missing" };
+  }
+  writeLine(stdout, `Installing ${requirement}...`);
+  const result = commandRunner(install.command, install.args, true);
+  if (!result.ok) {
+    writeLine(stderr, `Failed to install ${requirement}.`);
+    return { installed: false, status: "install-failed" };
+  }
+  return isCommandAvailable(commandRunner, platform, requirement) ? { installed: true, status: "ok" } : { installed: false, status: "install-failed" };
+}
+async function ensureRequirementAuthenticated(requirement, ask, commandRunner, stdout, stderr) {
+  if (isAuthenticated(requirement, commandRunner)) {
+    return { authenticated: true, status: "ok" };
+  }
+  if (!ask) {
+    writeLine(stderr, `${requirement} is installed but not logged in. Start in a TTY to log in automatically.`);
+    return { authenticated: false, status: "not-authenticated" };
+  }
+  if (!await confirm(ask, `"${requirement}" is installed but not logged in. Log in now?`)) {
+    return { authenticated: false, status: "not-authenticated" };
+  }
+  writeLine(stdout, `Opening ${requirement} login...`);
+  const login = buildLoginCommand(requirement);
+  const result = commandRunner(login.command, login.args, true);
+  if (!result.ok) {
+    writeLine(stderr, `Failed to complete ${requirement} login.`);
+    return { authenticated: false, status: "login-failed" };
+  }
+  return isAuthenticated(requirement, commandRunner) ? { authenticated: true, status: "ok" } : { authenticated: false, status: "login-failed" };
+}
+async function ensureStartupRequirements(storagePath, options = {}) {
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  if (shouldSkipStartupRequirementsCheck(storagePath, now)) {
+    return {
+      skipped: true,
+      metadata: resolveStartupRequirementsMetadata(storagePath)
+    };
+  }
+  const platform = options.platform ?? process.platform;
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  const commandRunner = options.commandRunner ?? createDefaultCommandRunner(platform);
+  const promptSession = createPromptSession(options.prompt);
+  const checkedAt = now.toISOString();
+  const checkedOn = formatLocalDate(now);
+  const components = {};
+  try {
+    for (const requirement of STARTUP_REQUIREMENTS) {
+      const installResult = await ensureRequirementInstalled(
+        requirement,
+        platform,
+        promptSession?.ask,
+        commandRunner,
+        stdout,
+        stderr
+      );
+      if (!installResult.installed) {
+        components[requirement] = {
+          installed: false,
+          status: installResult.status,
+          checkedAt
+        };
+        continue;
+      }
+      if (requirement === "az" || requirement === "devtunnel") {
+        const authResult = await ensureRequirementAuthenticated(
+          requirement,
+          promptSession?.ask,
+          commandRunner,
+          stdout,
+          stderr
+        );
+        components[requirement] = {
+          installed: true,
+          authenticated: authResult.authenticated,
+          status: authResult.status,
+          checkedAt
+        };
+        continue;
+      }
+      components[requirement] = {
+        installed: true,
+        status: "ok",
+        checkedAt
+      };
+    }
+  } finally {
+    await promptSession?.close();
+  }
+  const metadataFile = readStartupMetadataFile(storagePath);
+  const metadata = {
+    lastCheckedAt: checkedAt,
+    lastCheckedOn: checkedOn,
+    components
+  };
+  metadataFile.startupRequirements = metadata;
+  writeStartupMetadataFile(storagePath, metadataFile);
+  return {
+    skipped: false,
+    metadata
+  };
 }
 function parseArgs(argv) {
   const result = {};
@@ -33636,13 +34764,19 @@ function parseArgs(argv) {
           result.config = argv[++i];
         }
         break;
+      case "--reset":
+        result.reset = true;
+        break;
+      case "--disable-auth":
+        result.disableAuth = true;
+        break;
     }
   }
   return result;
 }
-function loadConfigFile(path16) {
+function loadConfigFile(path17) {
   try {
-    const raw = fs16.readFileSync(path16, "utf-8");
+    const raw = fs16.readFileSync(path17, "utf-8");
     return JSON.parse(raw);
   } catch {
     return {};
@@ -33746,6 +34880,67 @@ async function promptStartOptions(args, fileConfig, defaults, prompt) {
     await closePrompt?.();
   }
 }
+function applyStartMetadata(storagePath, args) {
+  const startup = resolveNodeStartupMetadata(storagePath);
+  const result = { ...args };
+  const loaded = {};
+  const persistedName = resolvePersistedDefaultNodeName(storagePath);
+  if (persistedName && result.name === void 0) {
+    loaded.name = persistedName;
+  }
+  if (startup.port !== void 0 && result.port === void 0) {
+    result.port = startup.port;
+    loaded.port = startup.port;
+  }
+  if (startup.transport && result.transport === void 0) {
+    result.transport = startup.transport;
+    loaded.transport = startup.transport;
+  }
+  if (startup.join && result.join === void 0) {
+    result.join = startup.join;
+    loaded.join = startup.join;
+  }
+  return {
+    args: result,
+    loaded: Object.keys(loaded).length > 0 ? loaded : void 0
+  };
+}
+function shouldCollectStartOptions(args, storagePath) {
+  return args.reset === true || !hasPersistedNodeStartupMetadata(storagePath);
+}
+function resolveRuntimeAuthMetadata(storagePath, disableAuth = false) {
+  const persisted = resolveNodeAuthMetadata(storagePath);
+  if (disableAuth) {
+    return { ...persisted, enabled: false };
+  }
+  if (!persisted.enabled && !persisted.allowSameTenant && persisted.allowedUsers.length === 0) {
+    return {
+      enabled: true,
+      allowSameTenant: false,
+      allowedUsers: []
+    };
+  }
+  return persisted;
+}
+function formatLoadedStartMetadata(info, authEnabled) {
+  const lines = ["Loaded startup options from metadata:"];
+  if (info.name) {
+    lines.push(`  Node: ${info.name}`);
+  }
+  if (info.port !== void 0) {
+    lines.push(`  Port: ${info.port}`);
+  }
+  if (info.transport) {
+    lines.push(`  Transport: ${info.transport}`);
+  }
+  if (info.join) {
+    lines.push(`  Join: ${info.join}`);
+  }
+  lines.push(`  Auth: ${authEnabled ? "enabled" : "disabled"}`);
+  return lines.join("\n");
+}
+
+// src/main.ts
 function formatBanner(info) {
   const lines = [
     `Node:      ${info.name}`,
@@ -33753,6 +34948,9 @@ function formatBanner(info) {
     `Endpoint:  ${info.endpoint}`,
     `Dashboard: http://localhost:${info.port}`
   ];
+  if (info.dashboardOrigin) {
+    lines.push(`Dashboard Tunnel: ${info.dashboardOrigin}`);
+  }
   const maxLen = Math.max(...lines.map((l) => l.length));
   const innerWidth = maxLen + 4;
   const top = `  \u256D${"\u2500".repeat(innerWidth)}\u256E`;
@@ -33774,16 +34972,53 @@ async function main() {
   const args = parseArgs(process.argv.slice(2));
   const configPath = args.config ?? "./config.json";
   const fileConfig = loadConfigFile(configPath);
-  const defaults = createRuntimeDefaultConfig(fileConfig);
-  const resolvedArgs = await promptStartOptions(args, fileConfig, defaults);
+  const storagePath = fileConfig.storage?.path ?? resolveDefaultStoragePath();
+  const hydratedArgs = args.reset ? { args: { ...args }, loaded: void 0 } : applyStartMetadata(storagePath, args);
+  const defaults = createRuntimeDefaultConfig(fileConfig, {
+    ignorePersistedName: args.reset === true
+  });
+  const resolvedArgs = shouldCollectStartOptions(args, storagePath) ? await promptStartOptions(
+    args.reset ? args : hydratedArgs.args,
+    fileConfig,
+    defaults
+  ) : hydratedArgs.args;
   const config = mergeConfig(defaults, fileConfig, resolvedArgs);
   persistDefaultNodeName(config.storage.path, config.node.name);
+  persistNodeStartupMetadata(config.storage.path, {
+    port: config.node.port,
+    transport: config.transport.type,
+    join: resolvedArgs.join
+  });
+  const authMetadata = resolveRuntimeAuthMetadata(config.storage.path, resolvedArgs.disableAuth === true);
+  if (!resolvedArgs.disableAuth) {
+    persistNodeAuthMetadata(config.storage.path, authMetadata);
+  }
+  console.log("Checking startup requirements (az, devtunnel, claude, codex)...");
+  const startupRequirements = await ensureStartupRequirements(config.storage.path);
+  console.log(
+    startupRequirements.skipped ? "Startup requirements already verified today; skipping checks." : "Startup requirements check complete."
+  );
   const logDir = nodePath.join(config.storage.path, "logs");
   const logger = createLogger({
     component: "node",
     logDir,
     console: true
   });
+  const nodeAuth = new AzureCliNodeAuth(config.storage.path, {
+    logger: logger.child("azure-auth"),
+    settingsProvider: () => authMetadata
+  });
+  if (hydratedArgs.loaded) {
+    console.log("");
+    console.log(formatLoadedStartMetadata(hydratedArgs.loaded, authMetadata.enabled));
+    console.log("");
+  }
+  if (authMetadata.enabled) {
+    nodeAuth.getAccessToken();
+    setRequestAuthHeadersProvider(() => nodeAuth.getAuthorizationHeaders());
+  } else {
+    setRequestAuthHeadersProvider(null);
+  }
   const meshyNode = new MeshyNode(config, {
     logger,
     transportFactory: createTransport
@@ -33793,9 +35028,24 @@ async function main() {
   const previewServer = new PreviewServer(previewSessionManager);
   const previewPort = config.node.port + 1;
   const actualPreviewPort = await previewServer.start(previewPort);
+  let dashboardTransport = null;
+  let dashboardOrigin;
   let previewTransport = null;
   let previewOrigin;
   let deps;
+  function createDashboardTransportConfig() {
+    return {
+      type: "devtunnel",
+      devtunnel: {
+        id: resolveOrCreateDevTunnelId(
+          config.storage.path,
+          meshyNode.getNodeRegistry().getSelf().id,
+          "dashboard"
+        ),
+        allowAnonymous: false
+      }
+    };
+  }
   function createPreviewTransportConfig() {
     return {
       type: "devtunnel",
@@ -33809,11 +35059,92 @@ async function main() {
       }
     };
   }
+  function setAdvertisedDashboardOrigin(origin) {
+    dashboardOrigin = origin;
+    deps.dashboardOrigin = origin;
+    meshyNode.getNodeRegistry().updateDashboardOrigin(meshyNode.getNodeRegistry().getSelf().id, origin);
+  }
   function setAdvertisedPreviewOrigin(origin) {
     previewOrigin = origin;
     deps.previewOrigin = origin;
     meshyNode.getNodeRegistry().updatePreviewOrigin(meshyNode.getNodeRegistry().getSelf().id, origin);
   }
+  function shouldPublishDashboardTunnel() {
+    return authMetadata.enabled && (meshyNode.getTransportType() === "devtunnel" || meshyNode.isDevTunnelEnabled());
+  }
+  async function stopDashboardTransport() {
+    if (!dashboardTransport) {
+      if (dashboardOrigin) {
+        setAdvertisedDashboardOrigin(void 0);
+      }
+      return;
+    }
+    await dashboardTransport.stop().catch(() => void 0);
+    dashboardTransport = null;
+    setAdvertisedDashboardOrigin(void 0);
+    meshyNode.getLogger().info("stopped dashboard tunnel", {
+      reason: "dashboard transport no longer required",
+      mainTransportType: meshyNode.getTransportType(),
+      sidecarEnabled: meshyNode.isDevTunnelEnabled()
+    });
+  }
+  async function restartDashboardTransport(transportConfig) {
+    const previousTransport = dashboardTransport;
+    const previousOrigin = dashboardOrigin;
+    let nextTransport = null;
+    try {
+      nextTransport = createTransport(transportConfig);
+      await nextTransport.start(config.node.port);
+      const nextOrigin = await nextTransport.getEndpoint();
+      dashboardTransport = nextTransport;
+      setAdvertisedDashboardOrigin(nextOrigin);
+      meshyNode.getLogger().info("started dashboard tunnel", {
+        dashboardOrigin: nextOrigin,
+        mainTransportType: meshyNode.getTransportType(),
+        sidecarEnabled: meshyNode.isDevTunnelEnabled()
+      });
+      if (previousTransport) {
+        await previousTransport.stop().catch(() => void 0);
+      }
+    } catch (err) {
+      if (nextTransport) {
+        await nextTransport.stop().catch(() => void 0);
+      }
+      dashboardTransport = previousTransport;
+      setAdvertisedDashboardOrigin(previousOrigin);
+      meshyNode.getLogger().warn("failed to start dashboard transport", {
+        error: err instanceof Error ? err.message : String(err),
+        port: config.node.port,
+        transportType: transportConfig.type
+      });
+    }
+  }
+  async function syncDashboardTransport(reason) {
+    if (!authMetadata.enabled) {
+      await stopDashboardTransport();
+      return;
+    }
+    if (!shouldPublishDashboardTunnel()) {
+      meshyNode.getLogger().info("skipping dashboard tunnel", {
+        reason,
+        mainTransportType: meshyNode.getTransportType(),
+        sidecarEnabled: meshyNode.isDevTunnelEnabled(),
+        authEnabled: authMetadata.enabled
+      });
+      await stopDashboardTransport();
+      return;
+    }
+    if (dashboardTransport && await dashboardTransport.isHealthy().catch(() => false)) {
+      meshyNode.getLogger().debug("dashboard tunnel already active", {
+        reason,
+        dashboardOrigin,
+        mainTransportType: meshyNode.getTransportType(),
+        sidecarEnabled: meshyNode.isDevTunnelEnabled()
+      });
+      return;
+    }
+    await restartDashboardTransport(createDashboardTransportConfig());
+  }
   async function restartPreviewTransport(transportConfig) {
     const previousTransport = previewTransport;
     const previousOrigin = previewOrigin;
@@ -33849,7 +35180,11 @@ async function main() {
     eventBus: meshyNode.getEventBus(),
     engineRegistry: meshyNode.getEngineRegistry(),
     logger: meshyNode.getLogger(),
-    config: { apiKey: config.cluster.apiKey },
+    config: {
+      apiKey: config.cluster.apiKey,
+      authMetadata,
+      validateBearerToken: authMetadata.enabled ? (header) => nodeAuth.validateAuthorizationHeader(header) : void 0
+    },
     workDir: meshyNode.getWorkDir(),
     persistNodeNamePreference: (name) => persistDefaultNodeName(config.storage.path, name),
     joinCurrentNodeToCluster: async (leaderEndpoint) => {
@@ -33859,12 +35194,28 @@ async function main() {
       await meshyNode.leaveCluster();
     },
     switchTransport: async (type) => {
-      return meshyNode.switchTransport(type);
+      const endpoint = await meshyNode.switchTransport(type);
+      persistNodeStartupTransport(config.storage.path, type);
+      await syncDashboardTransport(`switchTransport:${type}`);
+      return endpoint;
     },
     getTransportType: () => meshyNode.getTransportType(),
-    enableDevTunnel: async () => meshyNode.enableDevTunnel(),
-    disableDevTunnel: async () => meshyNode.disableDevTunnel(),
+    enableDevTunnel: async () => {
+      const endpoint = await meshyNode.enableDevTunnel();
+      persistNodeStartupTransport(config.storage.path, "devtunnel");
+      await syncDashboardTransport("enableDevTunnel");
+      return endpoint;
+    },
+    disableDevTunnel: async () => {
+      await meshyNode.disableDevTunnel();
+      persistNodeStartupTransport(
+        config.storage.path,
+        meshyNode.getTransportType()
+      );
+      await syncDashboardTransport("disableDevTunnel");
+    },
     isDevTunnelEnabled: () => meshyNode.isDevTunnelEnabled(),
+    dashboardOrigin,
     ensurePreviewOrigin: async () => {
       if (previewTransport && !await previewTransport.isHealthy()) {
         await previewTransport.stop().catch(() => void 0);
@@ -33880,7 +35231,16 @@ async function main() {
   };
   deps.previewSessionManager = previewSessionManager;
   deps.previewPort = actualPreviewPort;
+  deps.dashboardOrigin = dashboardOrigin;
   deps.previewOrigin = previewOrigin;
+  meshyNode.getLogger().info("configured node auth mode", {
+    authEnabled: authMetadata.enabled,
+    allowSameTenant: authMetadata.allowSameTenant,
+    allowedUsersCount: authMetadata.allowedUsers.length,
+    mainTransportType: meshyNode.getTransportType(),
+    sidecarEnabled: meshyNode.isDevTunnelEnabled()
+  });
+  await syncDashboardTransport("startup");
   const previewHealthTimer = setInterval(() => {
     void (async () => {
       if (!previewTransport) return;
@@ -33894,6 +35254,19 @@ async function main() {
       });
     })();
   }, config.cluster.heartbeatInterval);
+  const dashboardHealthTimer = setInterval(() => {
+    void (async () => {
+      if (!dashboardTransport) return;
+      const healthy = await dashboardTransport.isHealthy().catch(() => false);
+      if (healthy) return;
+      await dashboardTransport.stop().catch(() => void 0);
+      dashboardTransport = null;
+      setAdvertisedDashboardOrigin(void 0);
+      meshyNode.getLogger().warn("dashboard transport became unhealthy and was cleared", {
+        port: config.node.port
+      });
+    })();
+  }, config.cluster.heartbeatInterval);
   const app = createServer2(deps);
   const server = app.listen(config.node.port, () => {
     const self = meshyNode.getNodeRegistry().getSelf();
@@ -33904,7 +35277,8 @@ async function main() {
       role,
       term,
       endpoint: self.endpoint,
-      port: config.node.port
+      port: config.node.port,
+      dashboardOrigin
     });
     console.log("");
     console.log(banner);
@@ -33916,7 +35290,11 @@ async function main() {
     shuttingDown = true;
     console.log("\nShutting down...");
     try {
+      clearInterval(dashboardHealthTimer);
       clearInterval(previewHealthTimer);
+      if (dashboardTransport) {
+        await dashboardTransport.stop();
+      }
       if (previewTransport) {
         await previewTransport.stop();
       }
@@ -33945,9 +35323,12 @@ if (isDirectRun) {
   DEFAULT_CONFIG,
   DEFAULT_NODE_NAME,
   DEFAULT_NODE_PORT,
+  applyStartMetadata,
   createDefaultConfig,
   createRuntimeDefaultConfig,
+  ensureStartupRequirements,
   formatBanner,
+  formatLoadedStartMetadata,
   getDefaultNodeName,
   isDirectRunPath,
   loadConfigFile,
@@ -33955,7 +35336,11 @@ if (isDirectRun) {
   mergeConfig,
   parseArgs,
   promptStartOptions,
-  shouldPromptForStartOptions
+  resolveRuntimeAuthMetadata,
+  resolveStartupRequirementsMetadata,
+  shouldCollectStartOptions,
+  shouldPromptForStartOptions,
+  shouldSkipStartupRequirementsCheck
 });
 /*! Bundled license information: